langflow-ai/langflow · error · HTTPException

Flow is not public

Error message

Flow is not public

What it means

verify_public_flow_and_get_user() checks the flow exists in the database AND its access_type is AccessTypeEnum.PUBLIC; if either fails it raises 403 'Flow is not public'. The check runs before any session/virtual-flow-ID work, so a nonexistent flow id and a private flow id produce the same 403 (no existence oracle for private flows).

Source

Thrown at src/backend/base/langflow/api/utils/flow_utils.py:258

    Raises:
        HTTPException:
            - 400 if neither client_id nor authenticated_user_id is provided
            - 403 if flow doesn't exist or isn't public
            - 403 if unable to retrieve the flow owner user
            - 403 if user is not found for public flow
    """
    if not client_id and not authenticated_user_id:
        raise HTTPException(status_code=400, detail="No client_id cookie found")

    # Check if the flow is public
    async with session_scope() as session:
        from sqlmodel import select

        from langflow.services.database.models.flow.model import AccessTypeEnum, Flow

        flow = (await session.exec(select(Flow).where(Flow.id == flow_id))).first()
        if not flow or flow.access_type is not AccessTypeEnum.PUBLIC:
            raise HTTPException(status_code=403, detail="Flow is not public")

    # Use authenticated user_id for deterministic UUID when available, otherwise client_id.
    # Keep the branches explicit so identifier is non-optional at the UUID boundary.
    if authenticated_user_id is not None:
        identifier = str(authenticated_user_id)
        principal_type: Literal["user", "client"] = "user"
    else:
        if client_id is None:
            raise HTTPException(status_code=400, detail="No client_id cookie found")
        identifier = client_id
        principal_type = "client"
    new_flow_id = compute_virtual_flow_id(identifier, flow_id, principal_type=principal_type)

    # Get the user associated with the flow
    try:
        from langflow.helpers.user import get_user_by_flow_id_or_endpoint_name

        user = await get_user_by_flow_id_or_endpoint_name(str(flow_id))

View on GitHub (pinned to 976ec789d2)

Solutions

1. Open the flow in Langflow, go to flow Settings/Share, and set Access Type to Public, then retry.
2. Verify the flow id in the URL matches an existing flow (GET /api/v1/flows/{id} as the owner).
3. If the flow must stay private, call it authenticated as the owner (or via an API key) rather than through the public playground path.
4. Check you are connected to the right database/environment — a missing flow row here also yields this 403.

Example fix

# before: flow.access_type == PRIVATE
# (UI) Flow Settings -> Access Type: Private  -> 403 on public run

# after
# (UI) Flow Settings -> Access Type: Public, then:
curl -b jar.txt -X POST https://host/api/v1/run/{flow_id} -d '{}'

async def flow_is_public(api, flow_id: str) -> bool:
    r = await api.get(f'/api/v1/flows/{flow_id}')  # as owner / with token
    return r.status_code == 200 and r.json().get('access_type') == 'PUBLIC'

try:
    user, vfid = await verify_public_flow_and_get_user(flow_id, client_id)
except HTTPException as e:
    if e.status_code == 403 and e.detail == 'Flow is not public':
        raise RuntimeError('flip Access Type to Public in flow settings, or call authenticated as owner')
    raise

When it happens

Trigger: Requesting execution of a flow whose access_type is PRIVATE (the default), or a flow id that was deleted or never existed, via an endpoint that routes through verify_public_flow_and_get_user — with a valid client_id/auth context but no owner permissions. Also triggered if the flow was unshared after a client cached the public URL.

Common situations: The developer forgot to flip the flow to Public in the Langflow UI's flow settings (Share -> Public) before sharing the link; the flow was deleted or its access reverted to private; using a copied endpoint URL from another workspace; DB queries failing to resolve after a migration or when pointing at the wrong database.

Related errors

• No client_id cookie found
• Flow is not accessible
• Superuser required to administer role assignments.
• Superuser required to administer roles.
• Flow is not public

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/b60874b16a6c789f. Report an issue: GitHub.