What causes "Could not determine current admin email" in windmill-labs/windmill?

Refresh the page and log in again as the superadmin so getCurrentEmail() resolves

Could not determine current admin email

Error message

Could not determine current admin email

What it means

In submitAccount on the instance settings page, changing the superadmin's email is implemented as creating the new admin user then removing the old one, which requires knowing the current admin email. If neither the $superadmin store nor UserService.getCurrentEmail() yields a value, the page throws this error rather than proceeding and potentially locking out the admin.

Source

Thrown at frontend/src/routes/(root)/(logged)/user/(user)/instance_settings/+page.svelte:289

		yamlMode = false
		fullStep = 0
		mode = 'wizard'
	}

	function finishSetup() {
		goto('/user/workspaces')
	}

	async function submitAccount() {
		accountError = ''
		accountSubmitting = true
		try {
			let oldEmail = $superadmin
			if (!oldEmail) {
				oldEmail = await UserService.getCurrentEmail()
			}
			if (!oldEmail) {
				throw new Error('Could not determine current admin email')
			}

			await UserService.createUserGlobally({
				requestBody: {
					email: newEmail,
					password: newPassword,
					super_admin: true
				}
			})

			const token = await UserService.login({
				requestBody: { email: newEmail, password: newPassword }
			})

			// Update the client token for subsequent requests
			const { OpenAPI } = await import('$lib/gen')
			OpenAPI.TOKEN = token

View on GitHub (pinned to e474e8803c)

Solutions

Refresh the page and log in again as the superadmin so getCurrentEmail() resolves
Verify the session token is valid and not expired before submitting
Check GET current-email endpoint works in the network tab; investigate backend if it returns empty
Set the new email via CLI/DB directly if the UI flow stays blocked

Example fix

// before
let oldEmail = $superadmin
if (!oldEmail) oldEmail = await UserService.getCurrentEmail()
// after
let oldEmail = $superadmin
if (!oldEmail) {
  oldEmail = await UserService.getCurrentEmail()
  if (!oldEmail) throw new Error('Could not determine current admin email — re-login as superadmin and retry')
}

Defensive patterns

Strategy: try-catch

Validate before calling

let oldEmail = $superadmin ?? (await UserService.getCurrentEmail())
if (!oldEmail) {
  sendUserToast('Re-login as superadmin before changing the admin account', true)
  return
}

Type guard

function isNonEmptyString(v: unknown): v is string { return typeof v === 'string' && v.length > 0 }

Try / catch

try {
  await submitAccount()
} catch (e) {
  if (e.message === 'Could not determine current admin email') {
    await refreshSession() // re-auth then retry once
    await submitAccount()
  } else throw e
}

Prevention

Hydrate the $superadmin store on page load before enabling the account form
Handle 401 from getCurrentEmail() by redirecting to login instead of storing empty
Avoid long idle periods between loading settings and submitting (token expiry)
Keep a CLI/superadmin recovery path for account changes

When it happens

Trigger: Submitting the account-change form when the $superadmin store is empty AND UserService.getCurrentEmail() returns null/empty — e.g. the session user isn't resolvable as the current admin, or the API call failed silently.

Common situations: Calling the flow from a non-superadmin context; backend returning an empty current-email (auth token expired between page load and submit); a stale/blank superadmin store after instance config changed.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/ccd38b206392a237. Report an issue: GitHub.