What causes "Project owner not found" in langflow-ai/langflow?

Re-assign the project to an existing user (update Folder.user_id) or re-create the project under a valid account.

langflow-ai/langflow · error · HTTPException

Project owner not found

Error message

Project owner not found

What it means

In the MCP project auth helper, the project exists, its auth_settings.auth_type is 'oauth', and a valid composer backend token was presented — but the project has no user_id, or no User row exists for that user_id. The owner lookup is mandatory on this path because the composer token fast path authenticates AS the project owner; with no resolvable owner there is no principal to run tools as, so it 404s.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:134

    if not project:
        raise HTTPException(status_code=404, detail="Project not found")

    auth_settings: AuthSettings | None = None
    # Check if this project requires API key only authentication
    if project.auth_settings:
        auth_settings = AuthSettings(**project.auth_settings)

    project_auth_type = auth_settings.auth_type if auth_settings else None
    if project_auth_type == "oauth" and composer_backend_token:
        mcp_composer_service: MCPComposerService = cast(
            MCPComposerService, get_service(ServiceType.MCP_COMPOSER_SERVICE)
        )
        if mcp_composer_service.validate_backend_auth_token(str(project_id), composer_backend_token):
            if project.user_id:
                project_user = await db.get(User, project.user_id)
                if project_user:
                    return project_user
            raise HTTPException(status_code=404, detail="Project owner not found")

    # ``none`` intentionally publishes this project's MCP surface without a
    # credential. Keep that behavior, but never represent the anonymous caller
    # as the instance-wide superuser: tool execution must stay within the
    # published project's owning principal.
    if project_auth_type == "none":
        if project.user_id:
            project_user = await db.get(User, project.user_id)
            if project_user:
                return project_user
        raise HTTPException(status_code=404, detail="Project owner not found")

    # OAuth projects must present a valid API key at the Langflow transport endpoint: network-level
    # trust (loopback / same-host proxy) is unsafe because it cannot distinguish the local MCP
    # Composer subprocess from another loopback peer behind a reverse proxy or sidecar. The
    # composer-to-Langflow hop should be authenticated explicitly once mcp-composer can forward
    # a project-scoped backend credential; until then, direct backend access requires a key.
    requires_api_key = (not auth_settings and not settings_service.auth_settings.AUTO_LOGIN) or (

View on GitHub (pinned to 976ec789d2)

Solutions

Re-assign the project to an existing user (update Folder.user_id) or re-create the project under a valid account.
If a user was deleted, restore it or transfer ownership of the folder before publishing MCP.
Add a migration/consistency check that no published (oauth) folder has NULL user_id.
Verify with: SELECT id, user_id FROM folder WHERE id = '<project_id>';

Example fix

-- before: orphaned project
-- folder.user_id IS NULL

-- after: reassign owner
UPDATE folder SET user_id = (SELECT id FROM "user" WHERE username = 'owner') WHERE id = '<project_uuid>';

Defensive patterns

Strategy: validation

Try / catch

except HTTPException(404, 'Project owner not found') on the oauth+composer path: alert an admin to fix folder.user_id; not retryable.

Prevention

Enforce FK/consistency so folders always have an existing owner user.
When deleting users, transfer or delete their published projects first.

When it happens

Trigger: OAuth-published MCP project reached via MCP Composer with a valid backend token, where folder.user_id is NULL (orphaned project) or points at a deleted user.

Common situations: Projects orphaned by user deletion without cascade; manual DB edits or imports that dropped user_id; test fixtures creating folders without an owner.

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/6fde2df373216460. Report an issue: GitHub.