langflow-ai/langflow · error · HTTPException

Custom component creation is restricted to administrators

Error message

Custom component creation is restricted to administrators

What it means

Error "Custom component creation is restricted to administrators" thrown in langflow-ai/langflow.

Source

Thrown at src/backend/base/langflow/api/v1/endpoints.py:1374

    if _requires_component_hash_lookups(settings, user):
        # Lazily compute hash lookups if they haven't been built yet
        # (e.g. during startup before the cache is fully populated).
        get_component_hash_lookups_for_validation()
        all_known = component_cache.all_known_hashes
        if all_known is None:
            raise HTTPException(
                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
                detail="Component templates are still initializing. Please try again in a few seconds.",
            )

    # In admin-only mode, non-admin users may create/refresh only known server
    # templates. Truly custom code creation remains restricted to administrators.
    if (
        getattr(settings, "custom_component_admin_only", False) is True
        and not user.is_superuser
        and not code_hash_matches_any_template(raw_code.code, all_known)
    ):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Custom component creation is restricted to administrators",
        )

    if not settings.allow_custom_components and not code_hash_matches_any_template(raw_code.code, all_known):
        # Allow updating to a known server template (core component update),
        # but block truly custom code.
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Custom component creation is disabled",
        )

    # In restricted mode the request only reached here by matching a known
    # template hash. That hash is a truncated digest, so a second-preimage
    # collision could clear the gate with attacker-controlled bytes. Execute
    # the server's trusted copy keyed by the same hash instead of the client
    # bytes, and fail closed if no trusted source can be recovered.
    effective_code = raw_code.code

View on GitHub (pinned to 976ec789d2)

Solutions

1. Perform the operation as an administrator, or ask an admin to grant the required permission.

When it happens

Trigger: Occurs when a non-administrator user attempts to create a custom component while admin-only creation is enforced.

Common situations: See trigger scenarios.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/faab0f7b38256926. Report an issue: GitHub.