n8n-io/n8n · error · BadRequestError

400

400

Error message

You must enable two-factor authentication on your own account before enforcing it for all users

What it means

An admin attempts to enforce MFA instance-wide (`enforce: true`) while their own session did not use MFA (`req.authInfo.usedMfa === false`). n8n refuses the call as a lock-out guard: an admin who cannot use MFA themselves should not force it on everyone.

Source

Thrown at packages/cli/src/controllers/mfa.controller.ts:44

		private userRepository: UserRepository,
		private eventService: EventService,
		private instanceSettingsLoaderConfig: InstanceSettingsLoaderConfig,
	) {}

	@Post('/enforce-mfa')
	@GlobalScope('user:enforceMfa')
	async enforceMFA(req: MFA.Enforce) {
		if (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {
			throw new ForbiddenError(
				'MFA enforcement is managed via environment variables and cannot be modified through the API',
			);
		}

		if (req.body.enforce && !(req.authInfo?.usedMfa ?? false)) {
			// The current user tries to enforce MFA, but does not have
			// MFA set up for them self. We are forbidding this, to
			// help the user not lock them selfs out.
			throw new BadRequestError(
				'You must enable two-factor authentication on your own account before enforcing it for all users',
			);
		}
		await this.mfaService.enforceMFA(req.body.enforce);

		this.eventService.emit('instance-policies-updated', {
			user: {
				id: req.user.id,
				email: req.user.email,
				firstName: req.user.firstName,
				lastName: req.user.lastName,
				role: req.user.role,
			},
			settingName: '2fa_enforcement',
			value: req.body.enforce,
		});

		return;

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Enable MFA on your own account first: GET /rest/mfa/qr then POST /rest/mfa/enable, and re-authenticate with the code.
2. Re-issue the request from an MFA-authenticated session (usedMfa=true).

// Require the caller's own session to have used MFA before allowing enforce=true.
if (enforce && !authInfo.usedMfa) {
  throw new Error('Enable MFA on your own account first, then retry enforce.');
}
await restApi.post('/mfa/enforce-mfa', { enforce });

function sessionUsedMfa(a: { usedMfa?: boolean }): boolean {
  return a?.usedMfa === true;
}

When it happens

Trigger: POST /rest/mfa/enforce-mfa with body.enforce=true and the caller's authInfo.usedMfa falsy (session did not pass MFA).

Common situations: Newly promoted admin who never enrolled a TOTP; admin logged in via a session that skipped MFA; trying to flip the policy from a non-MFA browser.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Admin cannot reset password of global owner
• Admin cannot change role on global owner
• Authorization failed - insufficient permissions.
• Authorization failed - insufficient permissions for document
• MFA not used during authentication

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/44e4d04850b4f967. Report an issue: GitHub.