n8n-io/n8n · error · ForbiddenError

403

403

Error message

MFA enforcement is managed via environment variables and cannot be modified through the API

What it means

POST /rest/mfa/enforce-mfa is disabled because `instanceSettingsLoaderConfig.securityPolicyManagedByEnv` is true — the instance runs with env-driven security policy. In this mode, MFA enforcement can only be changed via environment variables, never through the API, so the endpoint refuses with 403.

Solutions

Toggle MFA enforcement through the relevant environment variable (e.g. the security/MFA env knob defined by your n8n version) and restart the instance.
If API control is required, unset the `securityPolicyManagedByEnv` flag in config so the API path is re-enabled.

Defensive patterns

Strategy: validation

Validate before calling

// Expose securityPolicyManagedByEnv via /settings and gate the UI control.
if (settings.securityPolicyManagedByEnv) {
  disableMfaEnforceToggle('MFA enforcement is env-managed — set it via environment variable.');
  return;
}

Prevention

Reflect the env-managed flag in the admin UI so the toggle is hidden/disabled.
Document the relevant env var next to the disabled control.
Restart n8n after changing the env var so config reloads.

When it happens

Trigger: POST /rest/mfa/enforce-mfa while `securityPolicyManagedByEnv` config flag is true.

Common situations: Enterprise/containerised deployment where security policies are pinned via env vars; helm/k8s chart sets the managed-by-env flag.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/bbdf7cfdf1181ab4. Report an issue: GitHub.

Appendix: source

Thrown at packages/cli/src/controllers/mfa.controller.ts:35

import { MfaService } from '@/mfa/mfa.service';
import { MFA } from '@/requests';

@RestController('/mfa')
export class MFAController {
	constructor(
		private mfaService: MfaService,
		private externalHooks: ExternalHooks,
		private authService: AuthService,
		private userRepository: UserRepository,
		private eventService: EventService,
		private instanceSettingsLoaderConfig: InstanceSettingsLoaderConfig,
	) {}

	@Post('/enforce-mfa')
	@GlobalScope('user:enforceMfa')
	async enforceMFA(req: MFA.Enforce) {
		if (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {
			throw new ForbiddenError(
				'MFA enforcement is managed via environment variables and cannot be modified through the API',
			);
		}

		if (req.body.enforce && !(req.authInfo?.usedMfa ?? false)) {
			// The current user tries to enforce MFA, but does not have
			// MFA set up for them self. We are forbidding this, to
			// help the user not lock them selfs out.
			throw new BadRequestError(
				'You must enable two-factor authentication on your own account before enforcing it for all users',
			);
		}
		await this.mfaService.enforceMFA(req.body.enforce);

		this.eventService.emit('instance-policies-updated', {
			user: {
				id: req.user.id,
				email: req.user.email,

View on GitHub (pinned to 5ac6606e81)