If LANGFLOW_AUTO_LOGIN=True, Langflow bypasses authentication for the visual editor and API requests.
@@ -132,18 +132,22 @@ If you don't have user management enabled, all users are effectively superu
Langflow doesn't allow users to simultaneously edit the same flow in real time.
If two users edit the same flow, Langflow saves only the work of the most recent editor based on the state of that user's workspace. Any changes made by the other user in the interim are overwritten.
-In Langflow versions 1.5 and later, most API endpoints require a Langflow API key, even when AUTO_LOGIN is True.
+
In Langflow versions 1.5 and later, most API endpoints require a Langflow API key, even when AUTO_LOGIN is true.
The only exceptions are the MCP endpoints /v1/mcp, /v1/mcp-projects, and /v2/mcp, which never require authentication.
-LANGFLOW_AUTO_LOGIN and LANGFLOW_SKIP_AUTH_AUTO_LOGIN options
In Langflow versions earlier than 1.5, if LANGFLOW_AUTO_LOGIN=true, then Langflow automatically logs users in as a superuser without requiring authentication.
-In this case, API requests don't require a Langflow API key.
In Langflow version 1.5, you can set LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true and LANGFLOW_AUTO_LOGIN=true to skip authentication for API requests and allow automatic login as a superuser for all users.
-This is a temporary bypass for backwards compatibility, and the LANGFLOW_SKIP_AUTH_AUTO_LOGIN option will be removed in a future release.
If either LANGFLOW_AUTO_LOGIN or LANGFLOW_SKIP_AUTH_AUTO_LOGIN are set to false, then authentication is required.
+LANGFLOW_AUTO_LOGIN and LANGFLOW_SKIP_AUTH_AUTO_LOGIN options
In Langflow versions earlier than 1.5, if LANGFLOW_AUTO_LOGIN=True, then Langflow automatically logs users in as a superuser without requiring authentication.
+In this case, API requests don't require a Langflow API key.
In Langflow version 1.5, you can set LANGFLOW_SKIP_AUTH_AUTO_LOGIN=True and LANGFLOW_AUTO_LOGIN=True to skip authentication for API requests and allow automatic login as a superuser for all users.
+This is a temporary bypass for backwards compatibility, and the LANGFLOW_SKIP_AUTH_AUTO_LOGIN option will be removed in a future release.
If either LANGFLOW_AUTO_LOGIN or LANGFLOW_SKIP_AUTH_AUTO_LOGIN are false, then authentication is required.
+
+Controls the availability of the langflow superuser command in the Langflow CLI.
+The default is true, but false is recommended to prevent unrestricted superuser creation.
+For more information, see langflow superuser.
These variables specify the username and password for the Langflow server's superuser.
_10LANGFLOW_SUPERUSER=administrator
_10LANGFLOW_SUPERUSER_PASSWORD=securepassword
-They are required if LANGFLOW_AUTO_LOGIN=false.
+
They are required if LANGFLOW_AUTO_LOGIN=False.
Otherwise, they aren't relevant.
-If required and not set, the default values are langflow and langflow.
-For more information, see Start a Langflow server with authentication enabled and the CLI command langflow superuser.
+If required and not set in when you start a Langflow server with authentication enabled, then the default values are langflow and langflow for system auto-login behavior.
+These defaults don't apply when using the Langflow CLI command langflow superuser.
This environment variable stores a secret key used for encrypting sensitive data like API keys.
Langflow uses the Fernet library for secret key encryption.
@@ -190,10 +194,6 @@ The superuser can also deactivate a user's account as needed.
_10LANGFLOW_NEW_USER_IS_ACTIVE=False
Only superusers can manage user accounts for a Langflow server, but user management only matters if your server has authentication enabled.
For more information, see Start a Langflow server with authentication enabled.
-
-Controls the availability of the langflow superuser command in the Langflow CLI.
-The default is True, but False is recommended to prevent unrestricted superuser creation.
-For more information, see langflow superuser.
This section shows you how to use the authentication environment variables to deploy a Langflow server with authentication enabled.
This involves disabling automatic login, setting superuser credentials, generating a secret encryption key, and enabling user management.
@@ -211,7 +211,7 @@ This example focuses on authentication variables.