langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Issue with cloudflare #20262

New Issue
Closed
opened 2026-02-21 20:06:32 -05:00 by yindo · 19 comments
yindo commented 2026-02-21 20:06:32 -05:00
Owner
Copy Link
Copy Source

Originally created by @FierdCS on GitHub (Nov 11, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

Version 1.9.2

Cloud or Self Hosted

Cloud

Steps to reproduce

Having issues uploading files onto Dify as there is a issue with cloudflare blowing my request:

here is my python function:

def upload_file(file_name):
upload_url = "https://api.dify.ai/v1/files/upload"
headers = {
"Authorization": f"Bearer {DIFY_API_KEY}",
"User-Agent": "Mozilla/5.0"
}

if not os.path.exists(file_name):
    raise FileNotFoundError(f"File not found: {file_name}")

with open(file_name, 'rb') as f:
    files = {'file': (file_name, f, 'text/plain')}
    data = {'user': "Sammy", 'type': 'document'}
    session = requests.Session()
    response = session.post(upload_url, headers=headers, files=files, data=data)

if response.status_code == 201:
    json_data = response.json()
    return json_data.get("id")
else:
    raise Exception(f"Failed to upload file: {response.status_code} {response.text}")

this has worked in the past but now I'm getting persistent issues with the request:
Here is my cloudflare ray id: 99d101373f6e1017

✔️ Expected Behavior

it should print out the upload id with my function

❌ Actual Behavior

No response

Originally created by @FierdCS on GitHub (Nov 11, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version Version 1.9.2 ### Cloud or Self Hosted Cloud ### Steps to reproduce Having issues uploading files onto Dify as there is a issue with cloudflare blowing my request: here is my python function: def upload_file(file_name): upload_url = "https://api.dify.ai/v1/files/upload" headers = { "Authorization": f"Bearer {DIFY_API_KEY}", "User-Agent": "Mozilla/5.0" } if not os.path.exists(file_name): raise FileNotFoundError(f"File not found: {file_name}") with open(file_name, 'rb') as f: files = {'file': (file_name, f, 'text/plain')} data = {'user': "Sammy", 'type': 'document'} session = requests.Session() response = session.post(upload_url, headers=headers, files=files, data=data) if response.status_code == 201: json_data = response.json() return json_data.get("id") else: raise Exception(f"Failed to upload file: {response.status_code} {response.text}") this has worked in the past but now I'm getting persistent issues with the request: Here is my cloudflare ray id: 99d101373f6e1017 ### ✔️ Expected Behavior it should print out the upload id with my function ### ❌ Actual Behavior _No response_
yindo added the 🐞 bugcloud labels 2026-02-21 20:06:32 -05:00
yindo closed this issue 2026-02-21 20:06:32 -05:00
yindo commented 2026-02-21 20:06:32 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

Your upload request is being blocked because the /v1/files/upload endpoint now requires several mandatory query parameters for security: timestamp, nonce, sign (HMAC signature), and tenant_id (and optionally user_id). These are not present in your current Python function, which is why the request fails signature verification and is likely rejected upstream—potentially triggering Cloudflare to block it as well. The endpoint checks these parameters for every upload and will return a forbidden error if they are missing or invalid. You’ll need to update your upload logic to include these parameters and generate a valid signature for each request. See the implementation details here.

There are no recent changes or middleware in the codebase related to Cloudflare that would affect uploads, so the issue is almost certainly with the missing parameters or signature. If you continue to see Cloudflare blocks after updating your request, check for any specific error codes or messages in the response, as Cloudflare may also block requests based on rate limits, IP reputation, or other security rules.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> Your upload request is being blocked because the /v1/files/upload endpoint now requires several mandatory query parameters for security: `timestamp`, `nonce`, `sign` (HMAC signature), and `tenant_id` (and optionally `user_id`). These are not present in your current Python function, which is why the request fails signature verification and is likely rejected upstream—potentially triggering Cloudflare to block it as well. The endpoint checks these parameters for every upload and will return a forbidden error if they are missing or invalid. You’ll need to update your upload logic to include these parameters and generate a valid signature for each request. See the implementation details [here](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/files/upload.py#L21-L126). There are no recent changes or middleware in the codebase related to Cloudflare that would affect uploads, so the issue is almost certainly with the missing parameters or signature. If you continue to see Cloudflare blocks after updating your request, check for any specific error codes or messages in the response, as Cloudflare may also block requests based on rate limits, IP reputation, or other security rules. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/27233149-5134-4215-a165-b028fa3139ba?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:32 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

can you send a sample

@FierdCS commented on GitHub (Nov 11, 2025): can you send a sample
yindo commented 2026-02-21 20:06:32 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

Here's a Python sample for uploading a file to the Dify API with the required security parameters. You'll need your DIFY_API_KEY, tenant_id, user_id (optional), and your secret key for signing. This example uses HMAC SHA-256 for the signature and includes all necessary query parameters:

import os
import time
import hmac
import hashlib
import base64
import requests

def upload_file(file_path, dify_api_key, tenant_id, secret_key, user_id=None):
    filename = os.path.basename(file_path)
    mimetype = "text/plain"  # Change if needed

    timestamp = str(int(time.time()))
    nonce = os.urandom(16).hex()
    key = secret_key.encode()
    msg = f"upload|{filename}|{mimetype}|{tenant_id}|{user_id or ''}|{timestamp}|{nonce}"
    sign = hmac.new(key, msg.encode(), hashlib.sha256).digest()
    encoded_sign = base64.urlsafe_b64encode(sign).decode()

    params = {
        "timestamp": timestamp,
        "nonce": nonce,
        "sign": encoded_sign,
        "tenant_id": tenant_id,
    }
    if user_id:
        params["user_id"] = user_id

    upload_url = "https://api.dify.ai/v1/files/upload"
    headers = {
        "Authorization": f"Bearer {dify_api_key}",
        "User-Agent": "Mozilla/5.0"
    }

    with open(file_path, "rb") as f:
        files = {"file": (filename, f, mimetype)}
        response = requests.post(upload_url, headers=headers, params=params, files=files)

    if response.status_code == 201:
        print("Upload ID:", response.json().get("id"))
        return response.json().get("id")
    else:
        print("Failed:", response.status_code, response.text)
        raise Exception(f"Failed to upload file: {response.status_code} {response.text}")

# Usage:
# upload_file("yourfile.txt", DIFY_API_KEY, TENANT_ID, SECRET_KEY, USER_ID)

This matches the server-side requirements for signature and parameters (reference). Make sure your secret key matches the one configured in your Dify instance. If you use a different mimetype, update it in both the message and the file tuple.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> Here's a Python sample for uploading a file to the Dify API with the required security parameters. You'll need your DIFY_API_KEY, tenant_id, user_id (optional), and your secret key for signing. This example uses HMAC SHA-256 for the signature and includes all necessary query parameters: ```python import os import time import hmac import hashlib import base64 import requests def upload_file(file_path, dify_api_key, tenant_id, secret_key, user_id=None): filename = os.path.basename(file_path) mimetype = "text/plain" # Change if needed timestamp = str(int(time.time())) nonce = os.urandom(16).hex() key = secret_key.encode() msg = f"upload|{filename}|{mimetype}|{tenant_id}|{user_id or ''}|{timestamp}|{nonce}" sign = hmac.new(key, msg.encode(), hashlib.sha256).digest() encoded_sign = base64.urlsafe_b64encode(sign).decode() params = { "timestamp": timestamp, "nonce": nonce, "sign": encoded_sign, "tenant_id": tenant_id, } if user_id: params["user_id"] = user_id upload_url = "https://api.dify.ai/v1/files/upload" headers = { "Authorization": f"Bearer {dify_api_key}", "User-Agent": "Mozilla/5.0" } with open(file_path, "rb") as f: files = {"file": (filename, f, mimetype)} response = requests.post(upload_url, headers=headers, params=params, files=files) if response.status_code == 201: print("Upload ID:", response.json().get("id")) return response.json().get("id") else: print("Failed:", response.status_code, response.text) raise Exception(f"Failed to upload file: {response.status_code} {response.text}") # Usage: # upload_file("yourfile.txt", DIFY_API_KEY, TENANT_ID, SECRET_KEY, USER_ID) ``` This matches the server-side requirements for signature and parameters ([reference](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/core/file/helpers.py#L28-L38)). Make sure your secret key matches the one configured in your Dify instance. If you use a different mimetype, update it in both the message and the file tuple. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a6896c7a-e33c-44b6-928f-e756ea928bf9?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:32 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

where do I find these

TENANT_ID, SECRET_KEY, USER_ID

@FierdCS commented on GitHub (Nov 11, 2025): where do I find these TENANT_ID, SECRET_KEY, USER_ID
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

Here's where you can find each value:

  • TENANT_ID is your workspace ID. You can get it from the Dify dashboard (in the workspace selector or workspace settings), or via the API at /workspaces/current—it’s the id field in the response.
  • USER_ID is your user/account ID. You can find it in your account/profile info or via API endpoints related to workspace members.
  • SECRET_KEY is only available to self-hosted administrators (set as an environment variable or config during deployment). If you’re using Dify Cloud, you do not have access to the SECRET_KEY—it’s not exposed in the UI or API and is managed by the platform operator.

References:

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> Here's where you can find each value: - TENANT_ID is your workspace ID. You can get it from the Dify dashboard (in the workspace selector or workspace settings), or via the API at /workspaces/current—it’s the id field in the response. - USER_ID is your user/account ID. You can find it in your account/profile info or via API endpoints related to workspace members. - SECRET_KEY is only available to self-hosted administrators (set as an environment variable or config during deployment). If you’re using Dify Cloud, you do not have access to the SECRET_KEY—it’s not exposed in the UI or API and is managed by the platform operator. References: - [TENANT_ID and USER_ID in API and UI](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/console/workspace/workspace.py#L44-L150) - [SECRET_KEY is a deployment-only config](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/configs/feature/__init__.py#L19-L29) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/b04610f7-2ce4-4d4a-99e3-4fba161e6661?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

send my api I need to ask to get these dumb ids

@FierdCS commented on GitHub (Nov 11, 2025): send my api I need to ask to get these dumb ids
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

You can get your workspace ID (TENANT_ID) by sending a GET request to the /workspaces/current endpoint, and your user/account ID (USER_ID) by sending a GET request to /account/profile. Both require your API key in the Authorization header.

Example requests:

# Get TENANT_ID (workspace ID)
curl -H "Authorization: Bearer <DIFY_API_KEY>" https://api.dify.ai/v1/workspaces/current

# Get USER_ID (account ID)
curl -H "Authorization: Bearer <DIFY_API_KEY>" https://api.dify.ai/v1/account/profile

The response JSON will have an id field with the value you need.
SECRET_KEY is only available for self-hosted setups; Dify Cloud users do not have access to it and cannot generate the required upload signature.
API reference: workspace and account endpoints

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> You can get your workspace ID (TENANT_ID) by sending a GET request to the `/workspaces/current` endpoint, and your user/account ID (USER_ID) by sending a GET request to `/account/profile`. Both require your API key in the Authorization header. Example requests: ```bash # Get TENANT_ID (workspace ID) curl -H "Authorization: Bearer <DIFY_API_KEY>" https://api.dify.ai/v1/workspaces/current # Get USER_ID (account ID) curl -H "Authorization: Bearer <DIFY_API_KEY>" https://api.dify.ai/v1/account/profile ``` The response JSON will have an `id` field with the value you need. SECRET_KEY is only available for self-hosted setups; Dify Cloud users do not have access to it and cannot generate the required upload signature. [API reference: workspace and account endpoints](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/console/workspace/workspace.py#L68-L150) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/51f2deee-6669-4d8b-ae7c-269f9b318a53?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

<!doctype html>

<html lang=en>

Not Found

The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.

@FierdCS commented on GitHub (Nov 11, 2025): <!doctype html> <html lang=en> <title>404 Not Found</title> <h1>Not Found</h1> <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

I need help the one you provided does not return

@FierdCS commented on GitHub (Nov 11, 2025): I need help the one you provided does not return
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

Please help me find a solution to upload files when I'm using the cloud environment to build the workflow

@FierdCS commented on GitHub (Nov 11, 2025): Please help me find a solution to upload files when I'm using the cloud environment to build the workflow
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

In Dify Cloud, you can't use the /v1/files/upload API endpoint for file uploads because it requires a SECRET_KEY you don't have access to. The supported way to upload files is through the workflow UI: use a file input (start node) in your workflow, then process those files with iteration, code, or HTTP nodes as needed. The UI handles file validation, size/type limits, and lets you pass uploaded files to downstream workflow steps. There are no documented or supported API workarounds for cloud users—file uploads must go through the UI until/unless Dify adds cloud API support. For details on workflow file handling, see the file upload logic in the codebase.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> In Dify Cloud, you can't use the /v1/files/upload API endpoint for file uploads because it requires a SECRET_KEY you don't have access to. The supported way to upload files is through the workflow UI: use a file input (start node) in your workflow, then process those files with iteration, code, or HTTP nodes as needed. The UI handles file validation, size/type limits, and lets you pass uploaded files to downstream workflow steps. There are no documented or supported API workarounds for cloud users—file uploads must go through the UI until/unless Dify adds cloud API support. For details on workflow file handling, see the [file upload logic in the codebase](https://github.com/langgenius/dify/pull/27480). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5babaa1b-abfe-488a-81df-a0536d7387dd?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

It used to work so now it doesn't why?

@FierdCS commented on GitHub (Nov 11, 2025): It used to work so now it doesn't why?
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

this works still

Image
@FierdCS commented on GitHub (Nov 11, 2025): this works still <img width="1264" height="426" alt="Image" src="https://github.com/user-attachments/assets/4d442e06-82bf-44a6-8181-f41f48bd32ee" />
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

The reason file uploads work from browser or Postman but not Python is that Dify Cloud's /v1/files/upload endpoint now requires extra security parameters—timestamp, nonce, sign (HMAC signature), and tenant_id—which must be generated using a secret key that is only available to self-hosted admins. Dify Cloud users do not have access to this key, so Python scripts can't generate the required signature, and the API rejects the request, often triggering Cloudflare to block it as suspicious. Browsers and Postman may work temporarily due to session cookies or other headers, but this is not a reliable or supported method for cloud users.

The only supported way to upload files in Dify Cloud is through the workflow UI, not via API or Python scripts. If you need programmatic uploads, you would need to self-host Dify where you control the secret key and full API access. More details on the security requirements are in the upload endpoint implementation and signature logic.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> The reason file uploads work from browser or Postman but not Python is that Dify Cloud's `/v1/files/upload` endpoint now requires extra security parameters—`timestamp`, `nonce`, `sign` (HMAC signature), and `tenant_id`—which must be generated using a secret key that is only available to self-hosted admins. Dify Cloud users do not have access to this key, so Python scripts can't generate the required signature, and the API rejects the request, often triggering Cloudflare to block it as suspicious. Browsers and Postman may work temporarily due to session cookies or other headers, but this is not a reliable or supported method for cloud users. The only supported way to upload files in Dify Cloud is through the workflow UI, not via API or Python scripts. If you need programmatic uploads, you would need to self-host Dify where you control the secret key and full API access. More details on the security requirements are in the [upload endpoint implementation](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/files/upload.py#L21-L122) and [signature logic](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/core/file/helpers.py#L8-L82). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/65e5ec02-2f56-4d3a-988c-25b6598746f3?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

Why did you guys remove this API request for cloud this is so frustrating

@FierdCS commented on GitHub (Nov 11, 2025): Why did you guys remove this API request for cloud this is so frustrating
yindo commented 2026-02-21 20:06:33 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 11, 2025):

Please help me set up API access as my whole workflow depends on it. Currently my workflow is in the cloud how do I import to different environment

@FierdCS commented on GitHub (Nov 11, 2025): Please help me set up API access as my whole workflow depends on it. Currently my workflow is in the cloud how do I import to different environment
yindo commented 2026-02-21 20:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 11, 2025):

Dify Cloud restricts API file uploads for security reasons—you can't use the /v1/files/upload API unless you self-host and configure your own SECRET_KEY. To regain API access, you'll need to migrate your workflow to a self-hosted Dify instance.

Here's how you can do it:

  1. Set up self-hosted Dify: Deploy Dify on your own server or cloud VM. During setup, generate a strong SECRET_KEY (e.g., with openssl rand -base64 42) and set it as the SECRET_KEY environment variable. This key is required for API-based file uploads and signature generation.
    Reference: SECRET_KEY config

  2. Export your workflow: Dify doesn't currently provide a one-click export/import for workflows in the cloud UI. You'll need to manually recreate your workflow in the self-hosted UI. To do this, open your workflow in Dify Cloud, copy the structure (nodes, connections, settings), and rebuild it step-by-step in your self-hosted Dify instance.
    Reference: workflow API

  3. Enable API file uploads: Once self-hosted, you can use the /v1/files/upload API. Your upload requests must include the required security parameters (timestamp, nonce, sign, tenant_id, and optionally user_id), with the signature generated using your SECRET_KEY.
    Reference: upload endpoint

  4. Get your tenant and user IDs: In self-hosted Dify, you can get these via the /workspaces/current and /account/profile endpoints.

  5. Reconfigure environment-specific settings: After migration, double-check any environment variables, credentials, or integrations, as these won't transfer automatically.

There is no automated migration tool, so manual recreation is required. Once set up, you'll have full API access—including file uploads—in your self-hosted environment. If you need a sample Python upload script or run into specific errors during setup, let me know!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 11, 2025): <!-- Answer --> Dify Cloud restricts API file uploads for security reasons—you can't use the /v1/files/upload API unless you self-host and configure your own SECRET_KEY. To regain API access, you'll need to migrate your workflow to a self-hosted Dify instance. Here's how you can do it: 1. **Set up self-hosted Dify:** Deploy Dify on your own server or cloud VM. During setup, generate a strong SECRET_KEY (e.g., with `openssl rand -base64 42`) and set it as the `SECRET_KEY` environment variable. This key is required for API-based file uploads and signature generation. [Reference: SECRET_KEY config](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/configs/feature/__init__.py#L19-L29) 2. **Export your workflow:** Dify doesn't currently provide a one-click export/import for workflows in the cloud UI. You'll need to manually recreate your workflow in the self-hosted UI. To do this, open your workflow in Dify Cloud, copy the structure (nodes, connections, settings), and rebuild it step-by-step in your self-hosted Dify instance. [Reference: workflow API](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/console/app/workflow.py#L60-L929) 3. **Enable API file uploads:** Once self-hosted, you can use the `/v1/files/upload` API. Your upload requests must include the required security parameters (`timestamp`, `nonce`, `sign`, `tenant_id`, and optionally `user_id`), with the signature generated using your SECRET_KEY. [Reference: upload endpoint](https://github.com/langgenius/dify/blob/5208867ccc7419402bf48afb7d273acf805fc75b/api/controllers/files/upload.py#L21-L122) 4. **Get your tenant and user IDs:** In self-hosted Dify, you can get these via the `/workspaces/current` and `/account/profile` endpoints. 5. **Reconfigure environment-specific settings:** After migration, double-check any environment variables, credentials, or integrations, as these won't transfer automatically. There is no automated migration tool, so manual recreation is required. Once set up, you'll have full API access—including file uploads—in your self-hosted environment. If you need a sample Python upload script or run into specific errors during setup, let me know! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/8a76af75-c76a-4d5d-aee5-33e4e830d394?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
yindo commented 2026-02-21 20:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@FierdCS commented on GitHub (Nov 12, 2025):

I've done the uv sync to set up api services now how do I get the SECRET_KEY

@FierdCS commented on GitHub (Nov 12, 2025): I've done the uv sync to set up api services now how do I get the SECRET_KEY
yindo commented 2026-02-21 20:06:34 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 12, 2025):

In self-hosted Dify, the SECRET_KEY is not generated or exposed by Dify after running 'uv sync'—it must be set manually by you as an environment variable or in your config file. To create a strong SECRET_KEY, run:

openssl rand -base64 42

Then set the result as the SECRET_KEY in your environment (for example, in your .env file or as an environment variable in your deployment). Dify reads this key for secure API operations, including file uploads. If you need to check if it's already set, look for SECRET_KEY in your server's environment variables or config files. For reference, see the config code and instructions here.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Nov 12, 2025): <!-- Answer --> In self-hosted Dify, the SECRET_KEY is not generated or exposed by Dify after running 'uv sync'—it must be set manually by you as an environment variable or in your config file. To create a strong SECRET_KEY, run: ```bash openssl rand -base64 42 ``` Then set the result as the `SECRET_KEY` in your environment (for example, in your `.env` file or as an environment variable in your deployment). Dify reads this key for secure API operations, including file uploads. If you need to check if it's already set, look for `SECRET_KEY` in your server's environment variables or config files. For reference, see the config code and instructions [here](https://github.com/langgenius/dify/blob/fe6538b08d786299a5c13c99f8593f8eae83a522/api/configs/feature/__init__.py#L19-L29). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/840c04ff-8cc3-4d4c-9713-f6c25c3f1b1d?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28094)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label cloud 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20262
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?