langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 12:36:14 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

401 Unauthorized: Invalid Authorization token, angent ReAct in my workfow #14477

New Issue
Closed
opened 2026-02-21 19:17:25 -05:00 by yindo · 8 comments
yindo commented 2026-02-21 19:17:25 -05:00
Owner
Copy Link
Copy Source

Originally created by @jp-sft on GitHub (Jun 7, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.4.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Issue Summary

Error occurs when calling a workflow tool from an Agent node in ReAct mode within a ChatFlow.

Reproduction Steps

  1. Create and publish a workflow as a tool

    • Create a new workflow
    • Configure the workflow parameters
    • Publish the workflow as a tool for use in other flows

  2. Create a ChatFlow with Agent node

    • Create a new ChatFlow
    • Add an Agent node configured in ReAct mode
    • Configure the Agent node to use the previously published workflow tool

  3. Test the workflow

    • Execute the ChatFlow
    • Trigger the Agent node to call the workflow tool
    • Error occurs when the tool is invoked

Visual Documentation

ChatFlow Configuration

ChatFlow Setup

Agent Node Configuration

Agent Node in ReAct Mode

Tool (Workflow) Configuration

Workflow Tool Setup

Additional Notes

  • Attempted fix using solution from #20347, but the same error persists
  • Error specifically occurs during tool invocation, not during setup or configuration

✔️ Expected Behavior

The Agent node should successfully call and execute the workflow tool without errors.

❌ Actual Behavior

Error occurs when the workflow tool is called by the Agent node in ReAct mode.

Image

{
"action_input": {},
"action_name": "test",
"observation": "tool invoke error: read tool response failed: request failed: 401 Unauthorized: Invalid Authorization token.",
"thought": ""
}

Originally created by @jp-sft on GitHub (Jun 7, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.4.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce ## Issue Summary Error occurs when calling a workflow tool from an Agent node in ReAct mode within a ChatFlow. ## Reproduction Steps 1. **Create and publish a workflow as a tool** - Create a new workflow - Configure the workflow parameters - Publish the workflow as a tool for use in other flows 2. **Create a ChatFlow with Agent node** - Create a new ChatFlow - Add an Agent node configured in ReAct mode - Configure the Agent node to use the previously published workflow tool 3. **Test the workflow** - Execute the ChatFlow - Trigger the Agent node to call the workflow tool - **Error occurs** when the tool is invoked ## Visual Documentation ### ChatFlow Configuration ![ChatFlow Setup](https://github.com/user-attachments/assets/deb2cd03-3804-4003-a2ac-6e89d78fbf6b) ### Agent Node Configuration ![Agent Node in ReAct Mode](https://github.com/user-attachments/assets/eca4ad24-c410-4fb2-b79f-5656be7177aa) ### Tool (Workflow) Configuration ![Workflow Tool Setup](https://github.com/user-attachments/assets/f2ad299e-ba89-4e16-922e-56fc19db8f37) ## Additional Notes - Attempted fix using solution from #20347, but the same error persists - Error specifically occurs during tool invocation, not during setup or configuration ### ✔️ Expected Behavior The Agent node should successfully call and execute the workflow tool without errors. ### ❌ Actual Behavior Error occurs when the workflow tool is called by the Agent node in ReAct mode. ![Image](https://github.com/user-attachments/assets/9c8748f0-5750-4eca-9d7e-6326ecc470dd) { "action_input": {}, "action_name": "test", "observation": "tool invoke error: read tool response failed: request failed: 401 Unauthorized: Invalid Authorization token.", "thought": "" }
yindo added the 🐞 bug🤖 feat:agent labels 2026-02-21 19:17:25 -05:00
yindo closed this issue 2026-02-21 19:17:25 -05:00
yindo commented 2026-02-21 19:17:25 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jun 7, 2025):

Hi @jp-sft! I'm Dosu and I’m helping the dify team.

The 401 Unauthorized error when invoking a workflow tool from an Agent node in ReAct mode is likely due to an invalid or missing authorization token in your self-hosted Docker setup. Here are the most common causes and steps to resolve:

  1. Double-check your .env file in the Docker setup. Make sure that SECRET_KEY, ACCESS_TOKEN_EXPIRE_MINUTES, and especially PLUGIN_DIFY_INNER_API_KEY are set and consistent across all relevant services. If PLUGIN_DIFY_INNER_API_KEY is not the same everywhere it’s required, internal API calls (like tool invocations from agents) will fail with authorization errors. See the example and notes in the Docker config files for reference on these variables and their roles "docker/.env.example".

  2. If you make any changes to the .env file, restart all Docker containers to ensure the new environment variables are loaded by every service "docker/README.md".

  3. Check that your access tokens have not expired. The default expiration is 60 minutes (ACCESS_TOKEN_EXPIRE_MINUTES=60). If your workflow or agent is using a stale token, you’ll get a 401 error.

  4. If you regenerated any keys or tokens, make sure all services are using the updated values and no old containers are running with outdated configs.

If you’ve already tried these steps and the error persists, please confirm that the .env file is identical for all containers and that no service is using a cached or old configuration. Let me know if you need help checking specific variables or logs.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Join Discord Share on X

@dosubot[bot] commented on GitHub (Jun 7, 2025): <!-- Greeting --> Hi @jp-sft! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the dify team. <!-- Answer --> The 401 Unauthorized error when invoking a workflow tool from an Agent node in ReAct mode is likely due to an invalid or missing authorization token in your self-hosted Docker setup. Here are the most common causes and steps to resolve: 1. Double-check your `.env` file in the Docker setup. Make sure that `SECRET_KEY`, `ACCESS_TOKEN_EXPIRE_MINUTES`, and especially `PLUGIN_DIFY_INNER_API_KEY` are set and consistent across all relevant services. If `PLUGIN_DIFY_INNER_API_KEY` is not the same everywhere it’s required, internal API calls (like tool invocations from agents) will fail with authorization errors. See the example and notes in the Docker config files for reference on these variables and their roles ["docker/.env.example"](https://github.com/langgenius/dify/blob/930c4cb60904f29b21f0cf5abf8da8063ed4ec7a/docker/.env.example). 2. If you make any changes to the `.env` file, restart all Docker containers to ensure the new environment variables are loaded by every service ["docker/README.md"](https://github.com/langgenius/dify/blob/930c4cb60904f29b21f0cf5abf8da8063ed4ec7a/docker/README.md). 3. Check that your access tokens have not expired. The default expiration is 60 minutes (`ACCESS_TOKEN_EXPIRE_MINUTES=60`). If your workflow or agent is using a stale token, you’ll get a 401 error. 4. If you regenerated any keys or tokens, make sure all services are using the updated values and no old containers are running with outdated configs. If you’ve already tried these steps and the error persists, please confirm that the `.env` file is identical for all containers and that no service is using a cached or old configuration. Let me know if you need help checking specific variables or logs. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/8e912c7b-8810-4ff1-a81b-286746daf873?feedback_type=other)</sup>&nbsp;&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/20777)
yindo commented 2026-02-21 19:17:25 -05:00
Author
Owner
Copy Link
Copy Source

@jp-sft commented on GitHub (Jun 7, 2025):

@dosu , i saw this in my env, # If this key is changed, DIFY_INNER_API_KEY in plugin_daemon service must also be updated or agent node will fail., how can update plugin_daemon service?

@jp-sft commented on GitHub (Jun 7, 2025): @dosu , i saw this in my env, `# If this key is changed, DIFY_INNER_API_KEY in plugin_daemon service must also be updated or agent node will fail.`, how can update plugin_daemon service?
yindo commented 2026-02-21 19:17:25 -05:00
Author
Owner
Copy Link
Copy Source

@jp-sft commented on GitHub (Jun 7, 2025):

@dosu , same error

@jp-sft commented on GitHub (Jun 7, 2025): @dosu , same error
yindo commented 2026-02-21 19:17:25 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jun 7, 2025):

There’s a known backend issue in Dify 1.4.1 that causes 401 errors when agent nodes in workflows call tools—the same tools work fine as standalone nodes. This is due to a bug in token handling, and a fix is scheduled for immediate release, so you may just need to update once it’s out. More details here: source.

If you want to double-check your setup in the meantime: make sure DIFY_INNER_API_KEY is identical in your .env, docker-compose.yaml, and any env files used by plugin_daemon, then restart all containers. Also, ensure your Authorization headers don’t have curly braces around the token (should be Bearer KEY, not Bearer {KEY}) source.

If you’ve already done all this and still see the error, it’s almost certainly the upstream bug. Watch for the next release and update as soon as it’s available.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Join Discord Share on X

@dosubot[bot] commented on GitHub (Jun 7, 2025): <!-- Answer --> There’s a known backend issue in Dify 1.4.1 that causes 401 errors when agent nodes in workflows call tools—the same tools work fine as standalone nodes. This is due to a bug in token handling, and a fix is scheduled for immediate release, so you may just need to update once it’s out. More details here: [source](https://github.com/langgenius/dify/issues/20392). If you want to double-check your setup in the meantime: make sure DIFY_INNER_API_KEY is identical in your .env, docker-compose.yaml, and any env files used by plugin_daemon, then restart all containers. Also, ensure your Authorization headers don’t have curly braces around the token (should be `Bearer KEY`, not `Bearer {KEY}`) [source](https://github.com/langgenius/dify/issues/18312). If you’ve already done all this and still see the error, it’s almost certainly the upstream bug. Watch for the next release and update as soon as it’s available. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/d471f611-b26b-4dc2-9038-7e6558a55c97?feedback_type=other)</sup>&nbsp;&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/20777)
yindo commented 2026-02-21 19:17:26 -05:00
Author
Owner
Copy Link
Copy Source

@laipz8200 commented on GitHub (Jun 7, 2025):

Duplicated #20340

@laipz8200 commented on GitHub (Jun 7, 2025): Duplicated #20340
yindo commented 2026-02-21 19:17:26 -05:00
Author
Owner
Copy Link
Copy Source

@laura-y7860 commented on GitHub (Jun 10, 2025):

Hello, I have pulled the changes made in #20340 but the error still persists. Is there any step that I have missed apart from pulling the commit?

Inside git log:
Image

Error:
Image

@laura-y7860 commented on GitHub (Jun 10, 2025): Hello, I have pulled the changes made in #20340 but the error still persists. Is there any step that I have missed apart from pulling the commit? Inside `git log`: ![Image](https://github.com/user-attachments/assets/255a5e83-3a68-4c41-87f7-2092504fa40b) Error: ![Image](https://github.com/user-attachments/assets/1af252de-ba0e-4058-8ce6-1ff0d90f0b90)
yindo commented 2026-02-21 19:17:26 -05:00
Author
Owner
Copy Link
Copy Source

@jp-sft commented on GitHub (Jun 10, 2025):

@laura-y7860, I just apply files diff (api/controllers/inner_api/plugin/wraps.py) as in #20374

@jp-sft commented on GitHub (Jun 10, 2025): @laura-y7860, I just apply files diff (api/controllers/inner_api/plugin/wraps.py) as in #20374
yindo commented 2026-02-21 19:17:26 -05:00
Author
Owner
Copy Link
Copy Source

@1169361410 commented on GitHub (Jun 29, 2025):

@jp-sft excuse me mate，so have u solved this problem?

@1169361410 commented on GitHub (Jun 29, 2025): @jp-sft excuse me mate，so have u solved this problem?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug 🤖 feat:agent
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#14477
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?