langgenius/dify · error · WorkSpaceNotAllowedCreateError

Workspace not found, please contact system admin to invite y

Error message

Workspace not found, please contact system admin to invite you to join in a workspace.

What it means

Originates as WorkSpaceNotAllowedCreateError at oauth.py:297 inside _generate_account: an existing OAuth-authenticated account has NO joined tenants, and FeatureService.is_workspace_creation_allowed() returns False. The OAuth callback handler catches it at oauth.py:239 and redirects the browser to /signin with the query message 'Workspace not found, please contact system admin to invite you to join in a workspace.' (the same text as NotAllowedCreateWorkspace). So the user sees a redirect, not a JSON error.

Source

Thrown at api/controllers/console/auth/oauth.py:297

    return account


def _generate_account(
    provider: str,
    user_info: OAuthUserInfo,
    timezone: str | None = None,
    language: str | None = None,
) -> tuple[Account, bool]:
    # Get account by openid or email.
    account = _get_account_by_openid_or_email(provider, user_info)
    oauth_new_user = False

    if account:
        tenants = TenantService.get_join_tenants(account, session=db.session())
        if not tenants:
            if not FeatureService.is_workspace_creation_allowed():
                raise WorkSpaceNotAllowedCreateError()
            else:
                TenantService.create_owner_tenant(account, session=db.session())

    if not account:
        normalized_email = user_info.email.lower()
        oauth_new_user = True
        if not FeatureService.get_system_features().is_allow_register:
            if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(
                normalized_email
            ):
                raise AccountRegisterError(
                    description=(
                        "This email account has been deleted within the past "
                        "30 days and is temporarily unavailable for new account registration"
                    )
                )
            raise AccountRegisterError(description=("Invalid email or password"))
        account_name = user_info.name or "Dify"

View on GitHub (pinned to ef8544b173)

Solutions

1. Have a workspace admin invite the user via /console/api/workspaces/invite so they join an existing tenant, bypassing the auto-create path.
2. If policy allows, enable workspace creation via FeatureService so the else-branch at oauth.py:299 runs create_owner_tenant.
3. Confirm the user is signing in with the same identity (openid/email) that is actually a member of a tenant — a different email can look like 'no tenants'.
4. Check that the user's account is not in a deleted/banned state that removed tenant memberships.

// Before relying on OAuth sign-in, ensure the user has a tenant membership.
// Admin-side: pre-create the membership so the OAuth callback's create path is not hit.
await adminInviteUser({email, workspace_id});

// In the OAuth redirect handler, parse the ?message= query.
const url = new URL(window.location.href);
if (url.searchParams.get('message')?.includes('Workspace not found')) {
  showContactAdminPrompt();
}

When it happens

Trigger: OAuth provider callback for a returning user whose account exists (matched by openid or email) but who has zero tenants, on a deployment where workspace creation is disabled (e.g. FeatureService policy or edition restricts it). TenantService.get_join_tenants returns empty -> WorkSpaceNotAllowedCreateError.

Common situations: SSO/OAuth user whose workspace was later deleted or who was removed from all tenants, trying to sign in again. Also occurs on managed deployments where self-service workspace creation is intentionally turned off and no admin invite exists for the user.

Related errors

• Invalid email or password
• access_denied
• server_5xx
• UsageMissingArg
• UsageInvalidFlag

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/a3666544c523ab7a. Report an issue: GitHub.