makeplane/plane · error · AuthenticationException

5016

5016

Error message

MAGIC_LINK_LOGIN_DISABLED

What it means

Raised in MagicCodeProvider.__init__ (magic_code.py:65) when ENABLE_MAGIC_LINK_LOGIN equals "0". The default is "1" (enabled) from the env fallback, so this only fires when an operator explicitly disables magic-link login. Code 5016, payload {email}. It is checked AFTER SMTP_NOT_CONFIGURED, so EMAIL_HOST is already non-empty here.

Source

Thrown at apps/api/plane/authentication/provider/credentials/magic_code.py:65

        (EMAIL_HOST, ENABLE_MAGIC_LINK_LOGIN) = get_configuration_value(
            [
                {"key": "EMAIL_HOST", "default": os.environ.get("EMAIL_HOST")},
                {
                    "key": "ENABLE_MAGIC_LINK_LOGIN",
                    "default": os.environ.get("ENABLE_MAGIC_LINK_LOGIN", "1"),
                },
            ]
        )

        if not (EMAIL_HOST):
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["SMTP_NOT_CONFIGURED"],
                error_message="SMTP_NOT_CONFIGURED",
                payload={"email": str(key)},
            )

        if ENABLE_MAGIC_LINK_LOGIN == "0":
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["MAGIC_LINK_LOGIN_DISABLED"],
                error_message="MAGIC_LINK_LOGIN_DISABLED",
                payload={"email": str(key)},
            )

        super().__init__(request=request, provider=self.provider, callback=callback)
        self.key = key
        self.code = code

    def initiate(self):
        ## Generate a random token
        token = str(secrets.randbelow(900000) + 100000)

        ri = redis_instance()

        key = "magic_" + str(self.key)

        # Check if the key already exists in python

View on GitHub (pinned to 1c8a60f858)

Solutions

  1. Set ENABLE_MAGIC_LINK_LOGIN=1 (or remove the "0" override) if magic-code login should be available.
  2. If disabled intentionally, update the client to offer only enabled auth methods.
  3. Persist the flag in instance configuration, not just env, so it is consistent across instances.

Example fix

# before: ENABLE_MAGIC_LINK_LOGIN=0 -> magic-code call -> 5016
# ENABLE_MAGIC_LINK_LOGIN=1
# after: magic-code provider constructs and issues tokens
Defensive patterns

Strategy: validation

Validate before calling

from plane.license.utils.instance_value import get_configuration_value
import os

def magic_link_enabled() -> bool:
    (val,) = get_configuration_value([{'key': 'ENABLE_MAGIC_LINK_LOGIN', 'default': os.environ.get('ENABLE_MAGIC_LINK_LOGIN', '1')}])
    return val != '0'

Try / catch

try:
    MagicCodeProvider(request, key=email)
except AuthenticationException as e:
    if e.error_code == 5016:
        offer_alternative_auth()
    else:
        raise

Prevention

When it happens

Trigger: Constructing MagicCodeProvider resolves ENABLE_MAGIC_LINK_LOGIN (default "1"). If it is "0", AuthenticationException code 5016 is raised. Hit by calling the magic-code request/verify endpoints while the feature is disabled.

Common situations: Security policy mandates password/OAuth-only auth; operator set ENABLE_MAGIC_LINK_LOGIN=0 to disable magic-code; partial config migration left the flag off.

Related errors

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/6f9b150f51179305. Report an issue: GitHub.