langfuse/langfuse · error · Error

Sign in with email and password is disabled for this instanc

Error message

Sign in with email and password is disabled for this instance. Please use SSO.

What it means

The credentials authorize() throws when the instance-level env var AUTH_DISABLE_USERNAME_PASSWORD=true, disabling password login entirely in favor of SSO.

Source

Thrown at web/src/server/auth.ts:97

  isV4UpgradeUiAvailable,
} from "@/src/features/events/lib/v4Rollout";
import { canCreateOrganizations } from "@/src/features/organizations/server/canCreateOrganizations";

const staticProviders: Provider[] = [
  CredentialsProvider({
    name: "credentials",
    credentials: {
      email: {
        label: "Email",
        type: "email",
        placeholder: "jsmith@example.com",
      },
      password: { label: "Password", type: "password" },
    },
    async authorize(credentials, _req) {
      if (!credentials) throw new Error("No credentials");
      if (env.AUTH_DISABLE_USERNAME_PASSWORD === "true")
        throw new Error(
          "Sign in with email and password is disabled for this instance. Please use SSO.",
        );

      const blockedDomains = getSSOBlockedDomains();
      const domain = credentials.email.split("@")[1]?.toLowerCase();
      if (domain && blockedDomains.includes(domain)) {
        throw new Error(
          "Sign in with email and password is disabled for this domain. Please use SSO.",
        );
      }

      // EE: Check custom SSO enforcement
      const multiTenantSsoProvider =
        await getSsoAuthProviderIdForDomain(domain);
      if (multiTenantSsoProvider) {
        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);
      }

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Sign in via the configured SSO provider instead
2. If password login should be allowed, unset AUTH_DISABLE_USERNAME_PASSWORD (or set it to false) and restart web
3. If you are the admin, confirm this disable was intentional before changing it

const canPasswordLogin = env.AUTH_DISABLE_USERNAME_PASSWORD !== 'true';
if (!canPasswordLogin) redirect user to SSO sign-in;

When it happens

Trigger: Any email/password sign-in attempt while AUTH_DISABLE_USERNAME_PASSWORD=true is set in the environment.

Common situations: Orgs enforcing SSO-only authentication set this flag; developers who copy a production .env locally then wonder why password login throws.

Related errors

• Sign in with email and password is disabled for this domain.
• No credentials
• ENTERPRISE_SSO_REQUIRED_MESSAGE
• Invalid credentials
• Please sign in with the identity provider (e.g. Google, GitH

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/6235ecd470e6555a. Report an issue: GitHub.