Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 14:13:35 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #1871] [BUG]: When using the API as an Admin user, I am getting 401 errors when attempting to create new users #1216

New Issue
Closed
opened 2026-02-22 18:23:44 -05:00 by yindo · 8 comments
yindo commented 2026-02-22 18:23:44 -05:00
Owner
Copy Link
Copy Source

Originally created by @ajferrario on GitHub (Jul 15, 2024).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/1871

Originally assigned to: @shatfield4 on GitHub.

How are you running AnythingLLM?

Docker (remote machine)

What happened?

When attempting to automate configuration of a deployed anythingllm environment I discovered that a valid API token
image
from an admin user
image
was returning 401 from the create users api after successfully hitting the /ping endpoint to prove that everything else is ok.
image
image
This indicated to me that multi-user mode is not enabled
image
but we know that can't be the case because multiple users have been created via GUI
image
So I'm a bit stuck on automating my environment setup right now because I can't do automated user creation.

Let me know how else I can support the investigation here! I've included my code and docker-compose file for reference in the repro steps.

Are there known steps to reproduce?

  • Create dockerized anythingllm using a dockerfile like this
    image: mintplexlabs/anythingllm
    container_name: anythingllm_test
    cap_add:
      - SYS_ADMIN
    environment:
    # Adjust for your environment
      - STORAGE_DIR=/app/server/storage
      - JWT_SECRET="make this a large list of random numbers and letters 20+"
      - LLM_PROVIDER=ollama
      - OLLAMA_BASE_PATH=http://ollama:11434
      - OLLAMA_MODEL_PREF=llama3:latest
      - OLLAMA_MODEL_TOKEN_LIMIT=4096
      - EMBEDDING_ENGINE=ollama
      - EMBEDDING_BASE_PATH=http://ollama:11434
      - EMBEDDING_MODEL_PREF=mxbai-embed-large:latest
      - EMBEDDING_MODEL_MAX_CHUNK_LENGTH=8192
      - VECTOR_DB=lancedb
      - WHISPER_PROVIDER=local
      - TTS_PROVIDER=native
      - PASSWORDMINCHAR=8
      - AGENT_SERPER_DEV_KEY="SERPER DEV API KEY"
      - AGENT_SERPLY_API_KEY="Serply.io API KEY"
    volumes:
      - anythingllm_storage:/app/server/storage
    networks:
      - distill_network
    restart: always

volumes:
  anythingllm_storage:

networks:
  distill_network:
    name: distill_network
    driver: bridge
  • Turn on multi-user mode
  • Create username and password
  • log in as admin user
  • generate API Key
  • Run the following python code with your api key. Ping should prove that the api key is valid.
import aiohttp
import json
import logging
import os
import asyncio

API_KEY = os.getenv("API_KEY")
ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD")
MANAGER_ACCOUNT_USERNAME = os.getenv("MANAGER_ACCOUNT_USERNAME")

# Set up logging
logging.basicConfig(level=logging.INFO)

# Call configuration
base_url = f"http://anythingllm_test:3001/api"
headers = {
    'Authorization': f'Bearer {API_KEY}',
    'Content-Type': 'application/json'
}
ping_headers = {
    'Authorization': f'Bearer {API_KEY}',
}

payload = {
  "username": MANAGER_ACCOUNT_USERNAME,
  "password": "CHANGEME01",
  "role": "default"
}

async def create_user() -> str:
    try:
        async with aiohttp.ClientSession() as session:
            async with session.get(base_url + "/ping", headers=ping_headers, ssl=False) as response:
                if response.status == 200:
                    resp = await response.json()
                    logging.info("Ping response received")
                    logging.info(f"{resp}")
                else:
                    logging.error(f"Failed to get ping response from server: {response.status}")
                    return "Failed to get ping response from server."

            async with session.post(base_url + "/admin/users/new", headers=headers, json=payload, ssl=False) as response:
                if response.status == 200:
                    resp = await response.json()
                    logging.info("create user response received")
                    logging.info(f"{resp}")
                    return resp.get("textResponse", "No message in response.")
                else:
                    logging.error(f'{response}')
                    logging.error(f"Failed to create user: {response.status}")
                    return "Failed to create user."
    except aiohttp.ClientError as e:
        logging.error(f"HTTP request failed: {e}")
        return "Failed to connect to the server."

# Run the create_user function
if __name__ == "__main__":
    result = asyncio.run(create_user())
    print(result)
  • Verify a response like the following
configure_customer  | INFO:root:Ping response received
configure_customer  | INFO:root:{'online': True}
configure_customer  | ERROR:root:<ClientResponse(http://anythingllm.test-customer:3001/api/admin/users/new) [401 Unauthorized]>
configure_customer  | <CIMultiDictProxy('X-Powered-By': 'Express', 'Vary': 'Origin', 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': '31', 'Etag': 'W/"1f-J3f56Tp3MQETl1YY4BuqOD/e+5g"', 'Date': 'Mon, 15 Jul 2024 06:53:24 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=5')>
configure_customer  | 
configure_customer  | ERROR:root:Failed to create user: 401
configure_customer  | Failed to create user.
configure_customer exited with code 0
Originally created by @ajferrario on GitHub (Jul 15, 2024). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/1871 Originally assigned to: @shatfield4 on GitHub. ### How are you running AnythingLLM? Docker (remote machine) ### What happened? When attempting to automate configuration of a deployed anythingllm environment I discovered that a valid API token ![image](https://github.com/user-attachments/assets/c4de037f-c92f-46c0-b0ab-9cdfe5b1e392) from an admin user ![image](https://github.com/user-attachments/assets/34b05f0a-8d76-4e75-84b2-c0e9e3709ec1) was returning 401 from the create users api after successfully hitting the /ping endpoint to prove that everything else is ok. ![image](https://github.com/user-attachments/assets/4ad5a142-b563-4f8b-9906-5f69ca975353) ![image](https://github.com/user-attachments/assets/95d570e4-56d4-4fb7-935f-1160f49c6048) This indicated to me that multi-user mode is not enabled ![image](https://github.com/user-attachments/assets/396605b6-b707-4f3a-bef8-f7632f430ffe) but we know that can't be the case because multiple users have been created via GUI ![image](https://github.com/user-attachments/assets/75fe4df3-d012-4118-9ceb-375299e9dd6c) So I'm a bit stuck on automating my environment setup right now because I can't do automated user creation. Let me know how else I can support the investigation here! I've included my code and docker-compose file for reference in the repro steps. ### Are there known steps to reproduce? - Create dockerized anythingllm using a dockerfile like this ``` anythingllm: image: mintplexlabs/anythingllm container_name: anythingllm_test cap_add: - SYS_ADMIN environment: # Adjust for your environment - STORAGE_DIR=/app/server/storage - JWT_SECRET="make this a large list of random numbers and letters 20+" - LLM_PROVIDER=ollama - OLLAMA_BASE_PATH=http://ollama:11434 - OLLAMA_MODEL_PREF=llama3:latest - OLLAMA_MODEL_TOKEN_LIMIT=4096 - EMBEDDING_ENGINE=ollama - EMBEDDING_BASE_PATH=http://ollama:11434 - EMBEDDING_MODEL_PREF=mxbai-embed-large:latest - EMBEDDING_MODEL_MAX_CHUNK_LENGTH=8192 - VECTOR_DB=lancedb - WHISPER_PROVIDER=local - TTS_PROVIDER=native - PASSWORDMINCHAR=8 - AGENT_SERPER_DEV_KEY="SERPER DEV API KEY" - AGENT_SERPLY_API_KEY="Serply.io API KEY" volumes: - anythingllm_storage:/app/server/storage networks: - distill_network restart: always volumes: anythingllm_storage: networks: distill_network: name: distill_network driver: bridge ``` - Turn on multi-user mode - Create username and password - log in as admin user - generate API Key - Run the following python code with your api key. Ping should prove that the api key is valid. ``` import aiohttp import json import logging import os import asyncio API_KEY = os.getenv("API_KEY") ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD") MANAGER_ACCOUNT_USERNAME = os.getenv("MANAGER_ACCOUNT_USERNAME") # Set up logging logging.basicConfig(level=logging.INFO) # Call configuration base_url = f"http://anythingllm_test:3001/api" headers = { 'Authorization': f'Bearer {API_KEY}', 'Content-Type': 'application/json' } ping_headers = { 'Authorization': f'Bearer {API_KEY}', } payload = { "username": MANAGER_ACCOUNT_USERNAME, "password": "CHANGEME01", "role": "default" } async def create_user() -> str: try: async with aiohttp.ClientSession() as session: async with session.get(base_url + "/ping", headers=ping_headers, ssl=False) as response: if response.status == 200: resp = await response.json() logging.info("Ping response received") logging.info(f"{resp}") else: logging.error(f"Failed to get ping response from server: {response.status}") return "Failed to get ping response from server." async with session.post(base_url + "/admin/users/new", headers=headers, json=payload, ssl=False) as response: if response.status == 200: resp = await response.json() logging.info("create user response received") logging.info(f"{resp}") return resp.get("textResponse", "No message in response.") else: logging.error(f'{response}') logging.error(f"Failed to create user: {response.status}") return "Failed to create user." except aiohttp.ClientError as e: logging.error(f"HTTP request failed: {e}") return "Failed to connect to the server." # Run the create_user function if __name__ == "__main__": result = asyncio.run(create_user()) print(result) ``` - Verify a response like the following ``` configure_customer | INFO:root:Ping response received configure_customer | INFO:root:{'online': True} configure_customer | ERROR:root:<ClientResponse(http://anythingllm.test-customer:3001/api/admin/users/new) [401 Unauthorized]> configure_customer | <CIMultiDictProxy('X-Powered-By': 'Express', 'Vary': 'Origin', 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': '31', 'Etag': 'W/"1f-J3f56Tp3MQETl1YY4BuqOD/e+5g"', 'Date': 'Mon, 15 Jul 2024 06:53:24 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=5')> configure_customer | configure_customer | ERROR:root:Failed to create user: 401 configure_customer | Failed to create user. configure_customer exited with code 0 ```
yindo added the possible buginvestigating labels 2026-02-22 18:23:44 -05:00
yindo closed this issue 2026-02-22 18:23:45 -05:00
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@ajferrario commented on GitHub (Jul 15, 2024):

Ok so I've now also tried with creating a workspace. I'm also getting 401 for that
image
which is strange since 401 isn't one of the documented error codes
image

Given this error has happened on 2 different endpoints I'm suspecting I've missed something obvious and I stand ready to be bonked on the head here if that's the case :D

@ajferrario commented on GitHub (Jul 15, 2024): Ok so I've now also tried with creating a workspace. I'm also getting 401 for that ![image](https://github.com/user-attachments/assets/550f215e-65ff-4583-8e1e-8dac89ac0c28) which is strange since 401 isn't one of the documented error codes ![image](https://github.com/user-attachments/assets/ef58bf26-bc7d-400c-8237-f2a5e1f2e18a) Given this error has happened on 2 different endpoints I'm suspecting I've missed something obvious and I stand ready to be bonked on the head here if that's the case :D
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 15, 2024):

Is the instance in multi-user mode? You cannot create users on an instance that is not in multi-user mode. You cannot swap the instance to multi-user from the API it must be done via the frontend.

Settings -> Sidebar -> Security -> Mulit-user mode (set username password for admin). Then you can create users via API

@timothycarambat commented on GitHub (Jul 15, 2024): Is the instance in multi-user mode? You cannot create users on an instance that is not in multi-user mode. You cannot swap the instance to multi-user from the API it must be done via the frontend. Settings -> Sidebar -> Security -> Mulit-user mode (set username password for admin). Then you can create users via API
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@ajferrario commented on GitHub (Jul 15, 2024):

Hey @timothyasp, thanks for the quick reply! In my writeup I have a screenshot showing that multiple users have been created in that instance. Here's a full screenshot of that view.
image

@ajferrario commented on GitHub (Jul 15, 2024): Hey @timothyasp, thanks for the quick reply! In my writeup I have a screenshot showing that multiple users have been created in that instance. Here's a full screenshot of that view. ![image](https://github.com/user-attachments/assets/0f395652-7adb-45ea-8e97-ca07e0971a3d)
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 15, 2024):

Wow i have no idea how i overlooked that - investigating!

@timothycarambat commented on GitHub (Jul 15, 2024): Wow i have no idea how i overlooked that - investigating!
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@ajferrario commented on GitHub (Jul 15, 2024):

No worries! I've continued my investigation too and found something interesting. I was referencing the Postman collection here.
https://www.postman.com/tcarambat/workspace/mintplex-labs/request/6334211-099b35ac-c51a-4a7c-af54-64001446e56f

And I wasn't using /api/v1 in my URLs as a result since that postman collection doesn't use them. This seems to work for the ping call but causes 401 on all other methods I've tried.

I switched all of my URLs other than ping to /api/v1 and now I'm getting 403 on all API calls other than ping. I'm still confused why this is the case as the API key is from an admin user on the account.
image

@ajferrario commented on GitHub (Jul 15, 2024): No worries! I've continued my investigation too and found something interesting. I was referencing the Postman collection here. https://www.postman.com/tcarambat/workspace/mintplex-labs/request/6334211-099b35ac-c51a-4a7c-af54-64001446e56f And I wasn't using /api/v1 in my URLs as a result since that postman collection doesn't use them. This seems to work for the ping call but causes 401 on all other methods I've tried. I switched all of my URLs other than ping to /api/v1 and now I'm getting 403 on all API calls other than ping. I'm still confused why this is the case as the API key is from an admin user on the account. ![image](https://github.com/user-attachments/assets/7e0c7f1d-cb60-402c-bb6c-bbb8bb195607)
yindo commented 2026-02-22 18:23:45 -05:00
Author
Owner
Copy Link
Copy Source

@ajferrario commented on GitHub (Jul 15, 2024):

Sorry for the rapidfire updates, but I also just tried using the Swagger GUI to test this, and on that GUI I'm able to execute the commands using the same API key successfully. For instance.
image
This makes me think it is still somehow something I'm doing wrong in my python implementation but I'm yet to discover what... Will update if I can find it.

@ajferrario commented on GitHub (Jul 15, 2024): Sorry for the rapidfire updates, but I also just tried using the Swagger GUI to test this, and on that GUI I'm able to execute the commands using the same API key successfully. For instance. ![image](https://github.com/user-attachments/assets/a3cf708e-e6a1-4ba9-b17f-ad021e4bb389) This makes me think it is still somehow something I'm doing wrong in my python implementation but I'm yet to discover what... Will update if I can find it.
yindo commented 2026-02-22 18:23:46 -05:00
Author
Owner
Copy Link
Copy Source

@ajferrario commented on GitHub (Jul 15, 2024):

Ok I found my dumb error in python. I wasn't using the accept:application/json header that the curl configuration used.

Sorry for the hassle :(.

Hopefully some good comes out of this in terms of maybe updating the postman collection? I think I didn't find my own error for a while because that collection didn't use the v1 urls.

@ajferrario commented on GitHub (Jul 15, 2024): Ok I found my dumb error in python. I wasn't using the accept:application/json header that the curl configuration used. Sorry for the hassle :(. Hopefully some good comes out of this in terms of maybe updating the postman collection? I think I didn't find my own error for a while because that collection didn't use the v1 urls.
yindo commented 2026-02-22 18:23:46 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 15, 2024):

Oh haha, yeah the postman collection is quite old - I think it might have even existed prior to us having the swagger docs live! If anything it should be removed at this point because of its incompatibility with the recent changes!

@timothycarambat commented on GitHub (Jul 15, 2024): Oh haha, yeah the postman collection is quite old - I think it might have even existed prior to us having the swagger docs live! If anything it should be removed at this point because of its incompatibility with the recent changes!
yindo changed title from [BUG]: When using the API as an Admin user, I am getting 401 errors when attempting to create new users to [GH-ISSUE #1871] [BUG]: When using the API as an Admin user, I am getting 401 errors when attempting to create new users 2026-06-05 14:39:35 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label investigating possible bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#1216
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?