langflow-ai/langflow · error · HTTPException

str(e)

Error message

str(e)

What it means

Raised by POST /api/v1/api_keys/ when create_api_key signals PermissionError — mapped to HTTP 403 with the exception text. Permission at this layer means the authenticated user is not allowed to perform the specific create operation (e.g. restrictions enforced by the service layer such as creating keys on behalf of another user, or policy plug-ins denying key creation), distinct from authentication failure which the CurrentActiveUser dependency handles with 401.

Source

Thrown at src/backend/base/langflow/api/v1/api_key.py:40

    try:
        user_id = current_user.id
        api_keys = await get_api_keys(db, user_id)
        return ApiKeysResponse(total_count=len(api_keys), user_id=user_id, api_keys=api_keys)
    except Exception as exc:
        raise HTTPException(status_code=400, detail=str(exc)) from exc


@router.post("/", include_in_schema=False)
async def create_api_key_route(
    req: ApiKeyCreate,
    current_user: CurrentActiveUser,
    db: DbSession,
) -> UnmaskedApiKeyRead:
    try:
        user_id = current_user.id
        return await create_api_key(db, req, user_id=user_id)
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e)) from e
    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e)) from e


@router.delete("/{api_key_id}", include_in_schema=False)
async def delete_api_key_route(
    api_key_id: UUID,
    db: DbSession,
    current_user: CurrentActiveUser,
):
    try:
        await delete_api_key(db, api_key_id, current_user.id)
    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e)) from e
    return {"detail": "API Key deleted"}


@router.post("/store", include_in_schema=False)

View on GitHub (pinned to 976ec789d2)

Solutions

1. Read the detail text — it states which permission failed
2. Create the key for yourself (omit the foreign user_id) or authenticate as a user permitted to administer that account
3. Request the required role/scope grant, or have an admin create the key, rather than retrying the same payload

Example fix

// before
POST /api/v1/api_keys/  {"name":"k","user_id":"<other-user-uuid>"}
// after
POST /api/v1/api_keys/  {"name":"k"}   // creates for the authenticated user

def can_create_for_self(req: dict) -> bool:
    return not req.get("user_id")  # only admins may pass a foreign user_id

try:
    key = client.post("/api/v1/api_keys/", json=payload).raise_for_status().json()
except HTTPStatusError as e:
    if e.response.status_code == 403:
        if payload.get("user_id"):
            payload.pop("user_id")          # retry for self
            key = client.post("/api/v1/api_keys/", json=payload).raise_for_status().json()
        else:
            raise PermissionDenied(e.response.json()["detail"]) from e
    raise

When it happens

Trigger: POST /api/v1/api_keys/ with an ApiKeyCreate payload that targets another user, exceeds a permitted scope/role the caller may not grant itself, or hits a deployment policy that denies key creation for the account.

Common situations: Admin-tooling creating keys with user_id set to someone else while authenticated as a normal user; RBAC/plugin deployments that restrict API-key issuance; attempting to mint a key with elevated scopes the caller lacks.

Related errors

• Superuser required to administer role assignments.
• Superuser required to administer roles.
• Cannot change folder of a flow you do not own.
• Cannot change fs_path of a flow you do not own.
• Cannot change a2a_enabled of a flow you do not own.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/c8d8cf5b69475881. Report an issue: GitHub.