makeplane/plane · error · AuthenticationException

5056

5056

Error message

EMAIL_PASSWORD_AUTHENTICATION_DISABLED

What it means

Raised in EmailProvider.__init__ (email.py:35) when the ENABLE_EMAIL_PASSWORD configuration value equals "0". The value is read from instance configuration, falling back to the ENABLE_EMAIL_PASSWORD env var. This gate disables the entire email/password credential provider before any credential check runs.

Source

Thrown at apps/api/plane/authentication/provider/credentials/email.py:35

class EmailProvider(CredentialAdapter):
    provider = "email"

    def __init__(self, request, key=None, code=None, is_signup=False, callback=None):
        super().__init__(request=request, provider=self.provider, callback=callback)
        self.key = key
        self.code = code
        self.is_signup = is_signup

        (ENABLE_EMAIL_PASSWORD,) = get_configuration_value([
            {
                "key": "ENABLE_EMAIL_PASSWORD",
                "default": os.environ.get("ENABLE_EMAIL_PASSWORD"),
            }
        ])

        if ENABLE_EMAIL_PASSWORD == "0":
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["EMAIL_PASSWORD_AUTHENTICATION_DISABLED"],
                error_message="EMAIL_PASSWORD_AUTHENTICATION_DISABLED",
            )

    def set_user_data(self):
        if self.is_signup:
            # Check if the user already exists
            if User.objects.filter(email=self.key).exists():
                self.logger.warning("User already exists")
                raise AuthenticationException(
                    error_message="USER_ALREADY_EXIST",
                    error_code=AUTHENTICATION_ERROR_CODES["USER_ALREADY_EXIST"],
                )

            super().set_user_data({
                "email": self.key,
                "user": {
                    "avatar": "",

View on GitHub (pinned to 1c8a60f858)

Solutions

1. Set ENABLE_EMAIL_PASSWORD=1 (or remove the "0" override) in instance config/env if email+password login is intended.
2. If SSO-only is intentional, update the client to use the configured OAuth/magic-code flow instead of email+password.
3. After changing the value, ensure it is persisted in the instance configuration store, not only the env, so it survives restarts.

Example fix

# before: ENABLE_EMAIL_PASSWORD=0 -> any email/password call -> 5056
# ENABLE_EMAIL_PASSWORD=1
# after: email/password provider constructs normally

from plane.license.utils.instance_value import get_configuration_value
import os

def email_password_enabled() -> bool:
    (val,) = get_configuration_value([{'key': 'ENABLE_EMAIL_PASSWORD', 'default': os.environ.get('ENABLE_EMAIL_PASSWORD')}])
    return val != '0'

try:
    EmailProvider(request, key=email, code=pw, is_signup=is_signup)
except AuthenticationException as e:
    if e.error_code == 5056:
        offer_alternative_auth_methods()
    else:
        raise

When it happens

Trigger: Constructing the EmailProvider (sign-in or sign-up) reads ENABLE_EMAIL_PASSWORD via get_configuration_value; if it resolves to the string "0", AuthenticationException code 5056 is raised immediately. Triggered by POSTing to the email/password sign-in or sign-up endpoints while the feature is disabled.

Common situations: Instance configured for SSO-only authentication (EMAIL_PASSWORD disabled), an operator toggled the feature off, or the env var was set to "0" during a security lockdown. Callers still hitting the legacy email/password endpoint see this.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• 5016
• 5025
• 5112
• 5030
• 5060

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/e7c4bf6a10de939b. Report an issue: GitHub.