Authentication and Security

Relevant source files

• .github/workflows/stress-tests.yml
• AGENTS.md
• CLAUDE.md
• docs/docs/Develop/api-keys-and-authentication.mdx
• src/backend/base/langflow/alembic/versions/1f4d6df60295_add_default_fields_column.py
• src/backend/base/langflow/alembic/versions/c153816fd85f_set_name_and_value_to_not_nullable.py
• src/backend/base/langflow/alembic/versions/d306e5c17c41_add_api_key_hash_column_to_apikey_table.py
• src/backend/base/langflow/alembic/versions/e3bc869fa272_fix_nullable.py
• src/backend/base/langflow/api/v1/api_key.py
• src/backend/base/langflow/api/v1/authz_me.py
• src/backend/base/langflow/api/v1/authz_shares.py
• src/backend/base/langflow/api/v1/login.py
• src/backend/base/langflow/api/v1/projects.py
• src/backend/base/langflow/services/auth/service.py
• src/backend/base/langflow/services/auth/utils.py
• src/backend/base/langflow/services/authorization/__init__.py
• src/backend/base/langflow/services/authorization/fetch.py
• src/backend/base/langflow/services/authorization/guards.py
• src/backend/base/langflow/services/authorization/listing.py
• src/backend/base/langflow/services/authorization/utils.py
• src/backend/base/langflow/services/database/models/api_key/crud.py
• src/backend/base/langflow/services/database/models/api_key/model.py
• src/backend/base/langflow/services/database/models/deployment/crud.py
• src/backend/base/langflow/services/database/models/deployment_provider_account/crud.py
• src/backend/base/langflow/services/database/models/user/crud.py
• src/backend/base/langflow/services/database/models/user/model.py
• src/backend/base/langflow/services/database/models/variable/model.py
• src/backend/base/langflow/services/telemetry_writer/__init__.py
• src/backend/base/langflow/services/telemetry_writer/factory.py
• src/backend/base/langflow/services/telemetry_writer/service.py
• src/backend/base/langflow/services/transaction/service.py
• src/backend/tests/unit/alembic/test_d306e5c17c41_backfill.py
• src/backend/tests/unit/api/v1/test_authz_admin_routes.py
• src/backend/tests/unit/api/v1/test_authz_share_routes.py
• src/backend/tests/unit/api/v1/test_projects.py
• src/backend/tests/unit/services/auth/test_auth_service.py
• src/backend/tests/unit/services/authorization/_common.py
• src/backend/tests/unit/services/authorization/test_capability_flag.py
• src/backend/tests/unit/services/authorization/test_fetch.py
• src/backend/tests/unit/services/authorization/test_filter_visible.py
• src/backend/tests/unit/services/authorization/test_listing_null_owner_prefilter.py
• src/backend/tests/unit/services/authorization/test_route_guard_regressions.py
• src/backend/tests/unit/services/database/models/__init__.py
• src/backend/tests/unit/services/database/models/api_key/__init__.py
• src/backend/tests/unit/services/database/models/api_key/test_crud.py
• src/backend/tests/unit/services/telemetry_writer/test_service.py
• src/backend/tests/unit/test_api_key_source.py
• src/backend/tests/unit/test_auth_settings.py
• src/backend/tests/unit/test_get_api_key.py
• src/backend/tests/unit/test_login.py
• src/backend/tests/unit/test_security_cors.py
• src/frontend/src/constants/__tests__/auth-token-expiration.test.ts
• src/frontend/vite-env-definitions.ts
• src/frontend/vite.config.mts
• src/lfx/src/lfx/services/authorization/base.py
• src/lfx/src/lfx/services/settings/auth.py
• src/lfx/src/lfx/services/settings/constants.py

This page documents Langflow's authentication and security mechanisms, including JWT-based sessions, API key management, middleware stacks, and authorization patterns.

Overview

Langflow implements a dual authentication system supporting both session-based (JWT cookies) and token-based (API keys) authentication. The system is designed to support multiple deployment scenarios:

• Multi-user deployments: Full authentication with user accounts, permissions, and access control handled via get_current_user src/backend/base/langflow/services/auth/utils.py175-181
• Single-user/auto-login mode: Simplified authentication for development where AUTO_LOGIN=true bypasses standard login flows and creates long-term tokens src/backend/base/langflow/api/v1/login.py112-167
• Public flows: Limited access for unauthenticated users via specific public endpoints or disabled authentication for webhooks via WEBHOOK_AUTH_ENABLE src/lfx/src/lfx/services/settings/auth.py96-100

All authentication logic is centralized in the AuthService (accessed via get_auth_service) and exposed through FastAPI dependency injection patterns src/backend/base/langflow/services/auth/utils.py83-90

Sources: src/backend/base/langflow/services/auth/utils.py1-181 src/backend/base/langflow/api/v1/login.py1-188 src/lfx/src/lfx/services/settings/auth.py45-125

Authentication Methods

Session-Based Authentication (JWT Cookies)

The primary authentication method uses JSON Web Tokens (JWT) stored in HttpOnly cookies. This provides secure, browser-compatible authentication.

JWT Authentication Sequence

Key Implementation Details: The OAuth2PasswordBearerCookie class extends FastAPI's standard OAuth2 to support cookie-based token extraction src/backend/base/langflow/services/auth/utils.py35-63

• Access Token: Stored in access_token_lf cookie src/backend/base/langflow/api/v1/login.py72-80
• Refresh Token: Stored in refresh_token_lf cookie src/backend/base/langflow/api/v1/login.py63-71
• Precedence: If an explicit Authorization: Bearer <token> header is provided, it takes precedence over the cookie in OAuth2PasswordBearerCookie.__call__ src/backend/base/langflow/services/auth/utils.py46-50
• External Auth: Supports external trusted credentials (e.g., from a gateway) as a final fallback src/backend/base/langflow/services/auth/utils.py57-59

Sources: src/backend/base/langflow/services/auth/utils.py35-63 src/backend/base/langflow/api/v1/login.py34-105

API Key Authentication

API keys provide programmatic access. Keys are validated via the api_key_security dependency which checks both header and query parameter sources src/backend/base/langflow/services/auth/utils.py151-155

API Key Sources (checked in order):

1. x-api-key HTTP header via api_key_header src/backend/base/langflow/services/auth/utils.py80
2. x-api-key query parameter via api_key_query src/backend/base/langflow/services/auth/utils.py79

Storage and Validation Logic: API keys can be sourced from two locations based on the API_KEY_SOURCE setting src/lfx/src/lfx/services/settings/auth.py74-81:

• db (Default): Validated against keys in the database via _check_key_from_db src/backend/base/langflow/services/database/models/api_key/crud.py144 Usage is tracked by incrementing total_uses and updating last_used_at src/backend/base/langflow/services/database/models/api_key/model.py34-35
• env: Validated against the LANGFLOW_API_KEY environment variable via _check_key_from_env src/backend/base/langflow/services/database/models/api_key/crud.py139-142

Security and Encryption: API keys are generated with 32 bytes of randomness src/backend/base/langflow/services/database/models/api_key/crud.py95 A SHA-256 hash of the key is stored in api_key_hash for indexed lookups src/backend/base/langflow/services/database/models/api_key/crud.py33-35 The actual key is stored encrypted using auth_utils.encrypt_api_key src/backend/base/langflow/services/database/models/api_key/crud.py97

Sources: src/backend/base/langflow/services/auth/utils.py77-81 src/backend/base/langflow/services/database/models/api_key/crud.py1-184 src/backend/base/langflow/api/v1/api_key.py14-54 src/lfx/src/lfx/services/settings/auth.py74-81

Middleware and Security Configuration

JWT Algorithm Support

Langflow supports both symmetric (HS256) and asymmetric (RS256, RS512) algorithms for JWT signing and verification src/lfx/src/lfx/services/settings/auth.py33-42 The key selection logic is handled in get_jwt_verification_key and get_jwt_signing_key src/backend/base/langflow/services/auth/utils.py115-148

Algorithm	Key Requirement	Logic
HS256	SECRET_KEY	Symmetric: SECRET_KEY is used for both signing and verification src/backend/base/langflow/services/auth/utils.py130-134
RS256/RS512	PRIVATE_KEY / PUBLIC_KEY	Asymmetric: PRIVATE_KEY signs src/backend/base/langflow/services/auth/utils.py146 PUBLIC_KEY verifies src/backend/base/langflow/services/auth/utils.py124-128

CORS Configuration

Langflow uses CORSMiddleware to control cross-origin access. By default, it allows wildcard origins * but warns about security implications when cors_allow_credentials is also True src/backend/tests/unit/test_security_cors.py17-41 Users can configure specific origins via LANGFLOW_CORS_ORIGINS src/backend/tests/unit/test_security_cors.py55-69

Sources: src/backend/base/langflow/services/auth/utils.py115-148 src/backend/tests/unit/test_security_cors.py1-156 src/lfx/src/lfx/services/settings/auth.py33-42

Authorization Patterns

Dependency Injection

Langflow uses FastAPI dependencies to enforce security across routes:

• get_current_user: Standard requirement for management APIs, extracting user identity from JWT or API keys src/backend/base/langflow/services/auth/utils.py175-181
• api_key_security: Validates x-api-key for execution endpoints src/backend/base/langflow/services/auth/utils.py151-155
• ws_api_key_security: Specialized for WebSockets to handle token validation during the handshake src/backend/base/langflow/services/auth/utils.py158-159

Request Authorization Flow

Sources: src/backend/base/langflow/services/auth/utils.py175-181 src/backend/base/langflow/services/database/models/api_key/crud.py101-117

RBAC and Enforcement

Langflow uses an authorization service to manage permissions for projects and flows.

• Permission Checks: Functions like ensure_project_permission check if a user can perform an action (e.g., ProjectAction.CREATE) src/backend/base/langflow/api/v1/projects.py79-81
• Resource Filtering: filter_visible_resources and visible_id_prefilter ensure users only see and interact with flows they own or have shared access to src/backend/base/langflow/api/v1/projects.py40-42
• Access Ceiling: An external access ceiling can be enabled to disable API key creation or usage for externally authenticated users src/backend/base/langflow/services/database/models/api_key/crud.py84-92 src/backend/base/langflow/services/database/models/api_key/crud.py160-175

Sources: src/backend/base/langflow/api/v1/projects.py36-60 src/backend/base/langflow/services/database/models/api_key/crud.py84-184

Encryption and Secrets

API Key Management

• Creation: create_api_key generates a sk- prefixed key, stores an encrypted version, and returns the plaintext key once src/backend/base/langflow/services/database/models/api_key/crud.py95-113
• Masking: The ApiKeyRead model masks all but the first 8 characters of the API key for safe display in the UI src/backend/base/langflow/services/database/models/api_key/model.py83-87

Global Variables and Credentials

Component API keys are stored as Variable entities.

• Credential Masking: The VariableRead model masks the value field if the variable is of type CREDENTIAL_TYPE src/backend/base/langflow/services/database/models/variable/model.py65-70
• Encryption: Variable values are stored encrypted in the database src/backend/base/langflow/services/database/models/variable/model.py20

Sources: src/backend/base/langflow/services/database/models/api_key/crud.py1-184 src/backend/base/langflow/services/database/models/api_key/model.py77-92 src/backend/base/langflow/services/database/models/variable/model.py1-79