n8n-io/n8n · warning · ForbiddenError

403

403

Error message

This account is managed via environment variables and cannot be modified through the API

What it means

A ForbiddenError (HTTP 403) from the PATCH /me/password (updatePassword) handler when isUserManagedByEnv(user) returns true. The owner account is pinned to environment variables, so its password cannot be rotated through the API — it must be changed via env config and a restart. Returns 403 because configuration forbids the mutation.

Source

Thrown at packages/cli/src/controllers/me.controller.ts:202

		return authIdentity.providerType === getCurrentAuthenticationMethod();
	}

	/**
	 * Update the logged-in user's password.
	 */
	@Patch('/password', {
		keyedRateLimit: createUserKeyedRateLimiter({}),
	})
	async updatePassword(
		req: AuthenticatedRequest,
		res: Response,
		@Body payload: PasswordUpdateRequestDto,
	) {
		const { user } = req;
		const { currentPassword, newPassword, mfaCode } = payload;

		if (this.isUserManagedByEnv(user)) {
			throw new ForbiddenError(
				'This account is managed via environment variables and cannot be modified through the API',
			);
		}

		// If SAML is enabled, we don't allow the user to change their password
		if (isSamlLicensedAndEnabled()) {
			this.logger.debug('Attempted to change password for user, while SAML is enabled', {
				userId: user.id,
			});
			throw new BadRequestError(
				'With SAML enabled, users need to use their SAML provider to change passwords',
			);
		}

		if (!user.password) {
			throw new BadRequestError('Requesting user not set up.');
		}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Rotate the owner password by updating the relevant environment variable and restarting n8n.
2. Disable ownerManagedByEnv to allow API-based password changes for the owner.
3. Use a non-owner account for API-driven password rotation.

// Detect env-managed owner before allowing password change.
const me = await api.get('/me');
if (me.flags?.ownerManagedByEnv && me.role === 'global:owner') {
  throw new Error('Owner password is env-managed; rotate via environment variables.');
}

function isEnvManagedOwner(u: { role: string }, cfg: { ownerManagedByEnv: boolean }): boolean {
  return cfg.ownerManagedByEnv && u.role === 'global:owner';
}

try {
  await api.patch('/me/password', payload);
} catch (e) {
  if (e.response?.status === 403 && /environment variables/i.test(e.response.data.message)) {
    notify('Rotate the owner password via environment variables.');
    return;
  }
  throw e;
}

When it happens

Trigger: PATCH /me/password for the owner user when ownerManagedByEnv is enabled and the user's email matches the configured owner email. Checked first, before the SAML and password-comparison guards.

Common situations: GitOps/Docker deployments that fix the owner via N8N_OWNER_EMAIL/PASSWORD env vars; an operator tries to change the owner password through the UI; env-managed owner where the password field is governed by N8N_OWNER_PASSWORD.

Related errors

• This account is managed via environment variables and cannot
• 400
• Admin cannot reset password of global owner
• Instance owner cannot be deleted.
• Admin cannot change role on global owner

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/70be0d5da49d6f01. Report an issue: GitHub.