langflow-ai/langflow · error · HTTPException

Missing superuser username in auth settings

Error message

Missing superuser username in auth settings

What it means

400 raised by _superuser_fallback: the request reached the unauthenticated AUTO_LOGIN-era path (project has no auth settings and AUTO_LOGIN is enabled), which resolves the configured superuser — but settings_service.auth_settings.SUPERUSER is empty. Without a superuser name there is no principal to run the MCP tools as, so the request is rejected as a misconfiguration rather than silently denied.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:199

        project_access = (
            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))
        ).first()

        if not project_access:
            raise HTTPException(status_code=404, detail="Project not found")

        return user

    # Legacy AUTO_LOGIN projects without explicit auth settings retain the
    # existing single-user fallback. Explicit public projects returned their
    # owner above and can never reach this system-superuser path.
    return await _superuser_fallback(db, settings_service)


async def _superuser_fallback(db: AsyncSession, settings_service) -> User:
    """Resolve the configured superuser for unauthenticated MCP paths that allow fallback."""
    if not settings_service.auth_settings.SUPERUSER:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Missing superuser username in auth settings",
        )
    result = await get_user_by_username(db, settings_service.auth_settings.SUPERUSER)
    if result:
        logger.warning(AUTO_LOGIN_WARNING)
        set_current_auth_context(AuthCredentialContext(method=AUTH_METHOD_AUTO_LOGIN))
        return result
    raise HTTPException(
        status_code=status.HTTP_403_FORBIDDEN,
        detail="Invalid user",
    )


# Smart authentication dependency that chooses method based on project settings
async def verify_project_auth_conditional(
    project_id: UUID,
    request: Request,

View on GitHub (pinned to 976ec789d2)

Solutions

  1. Set the superuser username (env LANGFLOW_SUPERUSER=<name>) on the Langflow instance and restart.
  2. Create that user if it does not exist (langflow superuser command or first-run setup).
  3. Preferably: give the project explicit auth_settings (apikey/none) so requests stop depending on the superuser fallback.
  4. Or turn AUTO_LOGIN off and use per-project API keys.

Example fix

# before (docker run)
docker run -e LANGFLOW_AUTO_LOGIN=true ... langflow

# after
docker run -e LANGFLOW_AUTO_LOGIN=true -e LANGFLOW_SUPERUSER=admin ... langflow
Defensive patterns

Strategy: validation

Validate before calling

import os

def auto_login_fallback_configured(auto_login: bool, superuser: str | None) -> bool:
    return not auto_login or bool(superuser)  # fallback path needs SUPERUSER set

Try / catch

except 400 'Missing superuser username': fix instance env (LANGFLOW_SUPERUSER) and restart; not a client retry case.

Prevention

When it happens

Trigger: AUTO_LOGIN=true with no SUPERUSER configured (env LANGFLOW_SUPERUSER unset), and an MCP project request that falls through to the legacy fallback (folder without auth_settings).

Common situations: Fresh installs that enabled auto-login but never ran superuser creation; docker/k8s deployments missing the LANGFLOW_SUPERUSER env var; disabling the superuser after setup while keeping AUTO_LOGIN on.

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/178767514ded5032. Report an issue: GitHub.