langflow-ai/langflow · warning · HTTPException

Incorrect username or password

Error message

Incorrect username or password

What it means

401 from POST /api/v1/login when authenticate_user returns no user — wrong username, wrong password, or the account cannot authenticate (e.g. inactive). It includes WWW-Authenticate: Bearer. This is the standard invalid-credentials response; server-side misfires produce 500 instead (see 449).

Source

Thrown at src/backend/base/langflow/api/v1/login.py:101

            str(user.store_api_key),
            httponly=auth_settings.ACCESS_HTTPONLY,
            samesite=auth_settings.ACCESS_SAME_SITE,
            secure=auth_settings.ACCESS_SECURE,
            expires=None,  # Set to None to make it a session cookie
            domain=auth_settings.COOKIE_DOMAIN,
        )
        await get_variable_service().initialize_user_variables(user.id, db)
        # Initialize agentic variables if agentic experience is enabled
        from langflow.api.utils.mcp.agentic_mcp import initialize_agentic_user_variables

        # Create default project for user if it doesn't exist
        _ = await get_or_create_default_folder(db, user.id)

        if get_settings_service().settings.agentic_experience:
            await initialize_agentic_user_variables(user.id, db)

        return tokens
    raise HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Incorrect username or password",
        headers={"WWW-Authenticate": "Bearer"},
    )


@router.get("/auto_login", include_in_schema=False)
async def auto_login(response: Response, db: DbSession):
    auth_settings = get_settings_service().auth_settings

    if auth_settings.AUTO_LOGIN:
        auth = get_auth_service()
        user_id, tokens = await auth.create_user_longterm_token(db)
        # The auto-login token is now short-lived, so set the refresh
        # cookie too — the client refreshes it transparently via /refresh instead
        # of relying on a year-long token.
        if tokens.get("refresh_token"):
            response.set_cookie(

View on GitHub (pinned to 976ec789d2)

Solutions

  1. Verify the username exists and the password is current (superuser: check LANGFLOW_SUPERUSER_PASSWORD / langflow superuser)
  2. Reset or recreate the user credential if forgotten
  3. Confirm the client sends username/password as x-www-form-urlencoded form fields, not JSON

Example fix

# before: JSON body (wrong)
requests.post(url, json={"username": "admin", "password": "x"})

# after: form-encoded
requests.post(url, data={"username": "admin", "password": "x"})
Defensive patterns

Strategy: validation

Validate before calling

if not username or not password:
    raise ValueError("credentials required")
resp = await client.post("/api/v1/login", data={"username": username, "password": password})

Try / catch

try:
    await client.post("/api/v1/login", data=form)
except httpx.HTTPStatusError as e:
    if e.response.status_code == 401:
        show_error("Incorrect username or password")  # do not retry blindly
    raise

Prevention

When it happens

Trigger: POST /login with a mistyped username/password; account created but auto_login/auto-creation paths not triggered; password reset but client still using the old one.

Common situations: Stored credentials changed (env var LANGFLOW_SUPERUSER_PASSWORD rotated), first-login after fresh install where the user was never created, frontend sending form fields with wrong keys so username arrives empty.

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/5a5b96b4d2084e3f. Report an issue: GitHub.