langflow-ai/langflow · error · HTTPException

No client_id cookie found

Error message

No client_id cookie found

What it means

verify_public_flow_and_get_user() requires some principal for anonymous shareable-playground requests: either a client_id cookie or an authenticated user. It raises 400 with 'No client_id cookie found' at the top of the function when both are absent, because every public-flow invocation must be attributable to a deterministic UUIDv5 virtual flow ID (per-session isolation).

Source

Thrown at src/backend/base/langflow/api/utils/flow_utils.py:248

    on the shareable playground.

    Args:
        flow_id: The original flow ID to verify
        client_id: The client ID from the request cookie
        authenticated_user_id: The authenticated user's ID (takes precedence over client_id)

    Returns:
        tuple: (flow owner user, deterministic flow ID for tracking)

    Raises:
        HTTPException:
            - 400 if neither client_id nor authenticated_user_id is provided
            - 403 if flow doesn't exist or isn't public
            - 403 if unable to retrieve the flow owner user
            - 403 if user is not found for public flow
    """
    if not client_id and not authenticated_user_id:
        raise HTTPException(status_code=400, detail="No client_id cookie found")

    # Check if the flow is public
    async with session_scope() as session:
        from sqlmodel import select

        from langflow.services.database.models.flow.model import AccessTypeEnum, Flow

        flow = (await session.exec(select(Flow).where(Flow.id == flow_id))).first()
        if not flow or flow.access_type is not AccessTypeEnum.PUBLIC:
            raise HTTPException(status_code=403, detail="Flow is not public")

    # Use authenticated user_id for deterministic UUID when available, otherwise client_id.
    # Keep the branches explicit so identifier is non-optional at the UUID boundary.
    if authenticated_user_id is not None:
        identifier = str(authenticated_user_id)
        principal_type: Literal["user", "client"] = "user"
    else:
        if client_id is None:

View on GitHub (pinned to 976ec789d2)

Solutions

1. Visit the flow's public playground page once so the backend can set the client_id cookie, then replay the API call with cookie jar enabled (curl -c/-b, or credentials: 'include' in fetch).
2. Or send an authenticated request (login session cookie / Authorization header) so authenticated_user_id is populated instead.
3. For programmatic clients, generate and persist your own client_id cookie value (any unique string) and send it on every request — the server only needs a stable identifier.
4. If embedding in an iframe, ensure SameSite/None-Secure cookie attributes and third-party cookies are allowed, or pass an API token instead.

Example fix

# before (no cookie, no auth -> 400)
curl -X POST https://host/api/v1/run/{flow_id} -d '{}'

# after
curl -c jar.txt https://host/  # obtains client_id cookie
curl -b jar.txt -X POST https://host/api/v1/run/{flow_id} -d '{}'

def ensure_principal(client_id: str | None, token: str | None) -> str:
    if token:
        return 'auth'  # authenticated path, no cookie needed
    if not client_id:
        raise PermissionError('missing client_id cookie — visit the flow page first or send credentials')
    return client_id

try:
    resp = await client.post(run_url, cookies={'client_id': cid})
except HTTPStatusError as e:
    if e.response.status_code == 400 and 'client_id' in e.response.text:
        cid = str(uuid.uuid4())
        resp = await client.post(run_url, cookies={'client_id': cid})
    else:
        raise

When it happens

Trigger: Calling a public flow execution endpoint (e.g. POST /api/v1/.../{flow_id} or the predictive-style build endpoint routed through verify_public_flow_and_get_user) with neither a client_id cookie in the request nor an authenticated session/Bearer token. Common with bare curl requests, server-to-server HTTP calls, or browsers that dropped/never set the client_id cookie.

Common situations: Testing a public flow URL with curl/Postman without first visiting the page that sets the client_id cookie; cookies blocked by third-party cookie policy when the flow is embedded in an iframe; a proxy or CORS configuration that strips Set-Cookie; calling the API from a backend script with no auth header.

Related errors

• Invalid filename
• Flow is not public
• This flow cannot be executed.
• Failed to install MCP
• No supported files found in folder. Allowed types: ${types?.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/6a350fd0ba7e446b. Report an issue: GitHub.