langflow-ai/langflow · error · HTTPException

Invalid API key

Error message

Invalid API key

What it means

401 from the MCP project auth path: an x-api-key credential WAS provided but authenticate_api_key returned no result — the key does not exist, is inactive/expired, or is malformed. The credential channel is correct; the value is not.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:176

        if not api_key:
            if project_auth_type == "oauth":
                detail = (
                    "This project is configured for OAuth authentication, but the MCP transport endpoint "
                    "currently requires a valid x-api-key header or query parameter for backend access. "
                    "Credential forwarding from MCP Composer is not yet available; use an API key in the "
                    "meantime."
                )
            else:
                detail = "API key required for this project. Provide x-api-key header or query parameter."
            raise HTTPException(
                status_code=401,
                detail=detail,
            )

        # Validate the API key
        api_key_result = await authenticate_api_key(db, api_key)
        if not api_key_result:
            raise HTTPException(status_code=401, detail="Invalid API key")
        set_current_auth_context(AuthCredentialContext.from_api_key_result(api_key_result))
        user = api_key_result.user

        # Verify user has access to the project
        project_access = (
            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))
        ).first()

        if not project_access:
            raise HTTPException(status_code=404, detail="Project not found")

        return user

    # Legacy AUTO_LOGIN projects without explicit auth settings retain the
    # existing single-user fallback. Explicit public projects returned their
    # owner above and can never reach this system-superuser path.
    return await _superuser_fallback(db, settings_service)

View on GitHub (pinned to 976ec789d2)

Solutions

  1. Create a fresh API key in Settings -> API Keys for the project owner and retry.
  2. Verify the exact key value reached the request (no trailing whitespace/newline in the env var or header).
  3. Confirm the key belongs to the same Langflow instance the MCP endpoint lives on.
  4. If keys were rotated, update every client/config that stored the old one.

Example fix

# before
api_key = os.environ["LANGFLOW_API_KEY"] + "\n"  # stray newline -> invalid

# after
api_key = os.environ["LANGFLOW_API_KEY"].strip()
Defensive patterns

Strategy: validation

Validate before calling

import re
# Langflow API keys look like 'lf-...' — sanity check shape and no stray whitespace
API_KEY_RE = re.compile(r'^\S+$')
def plausible_api_key(k: str) -> bool: return bool(k) and k == k.strip() and API_KEY_RE.match(k) is not None

Try / catch

except 401 'Invalid API key': stop retrying, rotate the key, update config, then retry once with the new key.

Prevention

When it happens

Trigger: x-api-key header/query containing a deleted or revoked key, a truncated key (copy lost characters), a key from a different Langflow instance, or a placeholder like 'YOUR_API_KEY'.

Common situations: Key rotated/revoked after a leak; env-var with quotes/newlines included; copy-paste from logs that redacted part of the key; pointing at the wrong environment (dev key against prod).

Understand the failure class

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/3c2578473217a837. Report an issue: GitHub.