#LangGraph auth not working

1 messages · Page 1 of 1 (latest)

knotty fossil
dapper depotBOT
#

This solution has been AI generated

It sounds like the frontend prop wiring is the missing piece. Auth with LangGraph in CopilotKit works by passing an authorization property from the frontend and handling it on the backend differently for LangGraph Platform vs. self‑hosted.

Frontend setup (required)

<CopilotKit
  runtimeUrl="/api/copilotkit"
  properties={{
    // must be exactly 'authorization'
    authorization: "your-user-token",
  }}
>
  <YourApp />
</CopilotKit>

Backend: choose your scenario

LangGraph Platform (Cloud)

CopilotKit forwards authorization as a Bearer token.

from langgraph_sdk import Auth
auth = Auth()

@auth.authenticate
async def authenticate(authorization: str | None):
    if not authorization or not authorization.startswith("Bearer "):
        raise Auth.exceptions.HTTPException(status_code=401)
    token = authorization.replace("Bearer ", "")
    # validate token here
    return {"identity": "user_123", "role": "admin"}

# In your node
async def my_node(state, config):
    user_info = config["configuration"]["langgraph_auth_user"]
    return state

Self‑hosted (Python SDK)

Bridge the frontend prop into the agent config via a factory function.

from copilotkit import CopilotKitRemoteEndpoint, LangGraphAGUIAgent

sdk = CopilotKitRemoteEndpoint(
    agents=lambda context: [
        LangGraphAGUIAgent(
            name="my_agent",
            description="Auth-enabled agent",
            graph=graph,
            langgraph_config={
                "configurable": {
                    "copilotkit_auth": context["properties"].get("authorization")
                }
            },
        )
    ],
)

async def my_node(state, config):
    auth_token = config["configurable"].get("copilotkit_auth")
    # validate token...
    return state

Troubleshooting

  • Use property name authorization (lowercase) on the frontend.
#
  • For self‑hosted, define agents as lambda context: [...] so properties are available at runtime.
  • On Platform, Bearer is added automatically; self‑hosted should handle prefixing/validation as shown.

Docs

Was this helpful?

If this solution worked for you, please click on the appropriate option below to help us improve:

knotty fossil
#

token is not reaching here @auth.authenticate
async def authenticate(authorization: str | None):
if not authorization or not authorization.startswith("Bearer "):
raise Auth.exceptions.HTTPException(status_code=401)
token = authorization.replace("Bearer ", "")
# validate token here ?!

knotty fossil
#

the frontend copilotkit provider properties are forwarded into the body not headers

#

as forwardedProps.authorization

quiet mango
#

@tidal gale, have you run into this?

knotty fossil
#

my fix was to manually transfer auth header into Langraph propertyHeaders, but this is not covered in the docs !

image.png