langflow-ai/langflow · error · HTTPException

Invalid user

Error message

Invalid user

What it means

403 from _superuser_fallback: SUPERUSER IS configured, but get_user_by_username found no User row with that username. The configuration names a principal that does not exist in the database, so the unauthenticated MCP fallback has no one to impersonate and denies the request.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:208

    # Legacy AUTO_LOGIN projects without explicit auth settings retain the
    # existing single-user fallback. Explicit public projects returned their
    # owner above and can never reach this system-superuser path.
    return await _superuser_fallback(db, settings_service)


async def _superuser_fallback(db: AsyncSession, settings_service) -> User:
    """Resolve the configured superuser for unauthenticated MCP paths that allow fallback."""
    if not settings_service.auth_settings.SUPERUSER:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Missing superuser username in auth settings",
        )
    result = await get_user_by_username(db, settings_service.auth_settings.SUPERUSER)
    if result:
        logger.warning(AUTO_LOGIN_WARNING)
        set_current_auth_context(AuthCredentialContext(method=AUTH_METHOD_AUTO_LOGIN))
        return result
    raise HTTPException(
        status_code=status.HTTP_403_FORBIDDEN,
        detail="Invalid user",
    )


# Smart authentication dependency that chooses method based on project settings
async def verify_project_auth_conditional(
    project_id: UUID,
    request: Request,
) -> User:
    """Choose authentication method based on project settings.

    - MCP Composer enabled + API key auth: Only allow API keys
    - All other cases: Use standard MCP auth (JWT + API keys)
    """
    async with session_scope() as session:
        # Get project to check auth settings
        project = (await session.exec(select(Folder).where(Folder.id == project_id))).first()

View on GitHub (pinned to 976ec789d2)

Solutions

1. Create the superuser: `langflow superuser` (or create the user with that exact username).
2. Verify the exact username matches: SELECT username FROM "user"; vs $LANGFLOW_SUPERUSER.
3. Restart Langflow after user creation if auth caches are involved.
4. Long term, set explicit per-project auth so the fallback is unused.

Example fix

# before: env names a missing user
LANGFLOW_SUPERUSER=owner  # no user 'owner' in DB

# after: align the two
uv run langflow superuser  # create user 'owner' with password
# or set LANGFLOW_SUPERUSER=admin where 'admin' exists

except 403 'Invalid user' from the fallback: verify the superuser account exists (langflow superuser), then retry.

When it happens

Trigger: LANGFLOW_SUPERUSER=admin while no user named 'admin' exists (never created, renamed, or deleted); pointing at a fresh database after configuring settings; username case/typo mismatch.

Common situations: Env var copied from another instance with a different admin username; superuser deleted during user cleanup; DB reset without re-running superuser creation.

Related errors

• Missing superuser username in auth settings
• Failed to download files: ${response.statusText}
• Failed to delete MCP Server
• Invalid file type
• Log retrieval is disabled

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/877279e5fd8cc08f. Report an issue: GitHub.