langflow-ai/langflow · error · HTTPException

This project is configured for OAuth authentication, but the

Error message

This project is configured for OAuth authentication, but the MCP transport endpoint currently requires a valid x-api-key header or query parameter for backend access. Credential forwarding from MCP Composer is not yet available; use an API key in the meantime.

What it means

401 raised when an MCP transport request targets an OAuth-configured project but carries no x-api-key header or query parameter. Langflow cannot verify OAuth at the transport hop (network-level trust is unsafe, and MCP Composer credential forwarding is not yet implemented), so OAuth projects still require an API key for the backend transport until composer can forward a project-scoped credential.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:168

    # composer-to-Langflow hop should be authenticated explicitly once mcp-composer can forward
    # a project-scoped backend credential; until then, direct backend access requires a key.
    requires_api_key = (not auth_settings and not settings_service.auth_settings.AUTO_LOGIN) or (
        project_auth_type in {"apikey", "oauth"}
    )

    if requires_api_key:
        api_key = query_param or header_param
        if not api_key:
            if project_auth_type == "oauth":
                detail = (
                    "This project is configured for OAuth authentication, but the MCP transport endpoint "
                    "currently requires a valid x-api-key header or query parameter for backend access. "
                    "Credential forwarding from MCP Composer is not yet available; use an API key in the "
                    "meantime."
                )
            else:
                detail = "API key required for this project. Provide x-api-key header or query parameter."
            raise HTTPException(
                status_code=401,
                detail=detail,
            )

        # Validate the API key
        api_key_result = await authenticate_api_key(db, api_key)
        if not api_key_result:
            raise HTTPException(status_code=401, detail="Invalid API key")
        set_current_auth_context(AuthCredentialContext.from_api_key_result(api_key_result))
        user = api_key_result.user

        # Verify user has access to the project
        project_access = (
            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))
        ).first()

        if not project_access:
            raise HTTPException(status_code=404, detail="Project not found")

View on GitHub (pinned to 976ec789d2)

Solutions

Supply a valid Langflow API key: header 'x-api-key: <key>' or query '?x-api-key=<key>' on the MCP transport requests.
If going through MCP Composer, ensure the composer backend auth token header is present and valid so the fast path applies.
Create an API key in Langflow (Settings -> API Keys) for the project owner if none exists.
Track/await composer credential forwarding support if you want passwordless OAuth-only MCP access.

Example fix

# before
await client.get(f"{base}/api/v1/mcp/project/{pid}/sse")

# after
await client.get(f"{base}/api/v1/mcp/project/{pid}/sse", headers={"x-api-key": LANGFLOW_API_KEY})

Defensive patterns

Strategy: validation

Validate before calling

def mcp_transport_ready(project_auth_type: str, has_api_key: bool, has_composer_token: bool) -> bool:
    if project_auth_type == 'oauth':
        return has_api_key or has_composer_token
    return True

Try / catch

except 401 with 'OAuth' in detail: attach x-api-key and retry once; otherwise surface config error.

Prevention

For OAuth projects, always provision an API key for the transport hop.
Keep the composer backend token header configured when routing via MCP Composer.

When it happens

Trigger: Calling /api/v1/mcp/project/{id}/ (or the conditional-auth endpoint) on a project with auth_type 'oauth' without an x-api-key header or ?x-api-key= query param and without a valid composer backend token.

Common situations: Assuming OAuth project = no API key needed for MCP; wiring MCP Composer without the backend token header; frontend-adjacent scripts calling the MCP endpoint with only a Bearer JWT when the project is oauth-typed.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/8887ab97d4910799. Report an issue: GitHub.