langflow-ai/langflow · warning · HTTPException

Invalid refresh token

Error message

Invalid refresh token

What it means

401 from POST /api/v1/auth/refresh (include_in_schema) when the refresh token cookie ('refresh_token_lf') is absent, expired, revoked, or fails validation. Includes WWW-Authenticate: Bearer. The refresh cookie is long-lived; this error means the session truly ended and the client must re-authenticate.

Source

Thrown at src/backend/base/langflow/api/v1/login.py:202

            "refresh_token_lf",
            tokens["refresh_token"],
            httponly=auth_settings.REFRESH_HTTPONLY,
            samesite=auth_settings.REFRESH_SAME_SITE,
            secure=auth_settings.REFRESH_SECURE,
            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,
            domain=auth_settings.COOKIE_DOMAIN,
        )
        response.set_cookie(
            "access_token_lf",
            tokens["access_token"],
            httponly=auth_settings.ACCESS_HTTPONLY,
            samesite=auth_settings.ACCESS_SAME_SITE,
            secure=auth_settings.ACCESS_SECURE,
            expires=auth_settings.ACCESS_TOKEN_EXPIRE_SECONDS,
            domain=auth_settings.COOKIE_DOMAIN,
        )
        return tokens
    raise HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Invalid refresh token",
        headers={"WWW-Authenticate": "Bearer"},
    )


@router.get("/session", include_in_schema=False)
async def get_session(
    request: Request,
    db: DbSession,
) -> SessionResponse:
    """Validate session and return user information.

    This endpoint checks if the user is authenticated via cookie or Authorization header.
    It does not raise an error if unauthenticated, allowing the frontend to gracefully
    handle the session state.
    """
    from langflow.services.auth.utils import _get_external_token, oauth2_login

View on GitHub (pinned to 976ec789d2)

Solutions

1. Redirect the user to the login page and POST /login again to mint fresh cookies
2. Verify cookies are actually sent (same-site policy, COOKIE_DOMAIN matches the host)
3. Ensure LANGFLOW_SECRET_KEY is stable across restarts so tokens survive deploys

Example fix

// before
const { data } = await api.post('/api/v1/auth/refresh');

// after
try {
  const { data } = await api.post('/api/v1/auth/refresh');
} catch (e) {
  if (e.response?.status === 401) window.location.href = '/login'; // session over
}

try:
    await client.post("/api/v1/auth/refresh")
except httpx.HTTPStatusError as e:
    if e.response.status_code == 401:
        await credential_login(client)  # refresh cookie dead: full re-login
    else:
        raise

When it happens

Trigger: POST /refresh after cookie expiry, after logout revoked the token, cross-domain cookie not sent (COOKIE_DOMAIN mismatch), or a fresh browser with no prior login.

Common situations: Long-idle tab waking up past the refresh window; cookie blocked in embedded iframes / third-party contexts; server restart with a new LANGFLOW_SECRET_KEY invalidating old signed tokens; clock skew.

Related errors

• Incorrect username or password
• API key required
• Invalid API key
• An error occurred during authentication
• Auto login is disabled.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/210dd5d004ed6c3c. Report an issue: GitHub.