Headless initialization creates org OWNER but project VIEWER (cannot create prompts)

[soumen-eric]

Describe your question

Description

When using Headless Initialization (self-hosted) in Langfuse OSS, the initialized admin user is correctly created as OWNER at the organization level, but is unexpectedly assigned VIEWER role at the project level.
Due to this, the initialized admin user cannot create prompts in the initialized project, which contradicts the expected behavior and documentation.

Initialization method: Headless Initialization via environment variables

Initialization Configuration
LANGFUSE_INIT_ORG_ID=poc-org
LANGFUSE_INIT_ORG_NAME=POC

LANGFUSE_INIT_PROJECT_ID=lang-prompt-project
LANGFUSE_INIT_PROJECT_NAME=lang_prompt
LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-lf-poc-lang-prompt
LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-lf-poc-lang-prompt

LANGFUSE_INIT_USER_EMAIL=admin@example.com
LANGFUSE_INIT_USER_NAME=Admin User
LANGFUSE_INIT_USER_PASSWORD=admin123

Expected Behavior
admin@example.com should:
Be OWNER of the initialized organization
Be OWNER (or ADMIN) of the initialized project
Be able to create, edit, and manage prompts

This matches the expectation of a bootstrap admin user.

Actual Behavior
admin@example.com is:
✅ OWNER in organizations_users
❌ VIEWER in projects_users
As a result:
❌ Cannot create prompts
❌ Cannot manage project resources

Database observation:

Org role: OWNER
Project role: VIEWER

UI Observation
In Langfuse UI:
User appears as Owner for the organization
But project permissions behave as read-only

If the same user manually creates a new org or project from the UI:
User becomes full Owner and Prompt creation works as expected

Is this behavior expected!!

Langfuse Cloud or Self-Hosted?

Self-Hosted

If Self-Hosted

v3.149.0

If Langfuse Cloud

NO

SDK and integration versions

No response

Pre-Submission Checklist

• I have checked for existing issues/discussions and consulted Langfuse AI.

[inkeep-ai-assistant[bot]]

This behavior is influenced by the Automated Access Provisioning settings, specifically LANGFUSE_DEFAULT_PROJECT_ROLE(1)(2). When you use headless initialization together with automated access provisioning, the initial user created via LANGFUSE_INIT_USER_* is correctly assigned as OWNER of the organization(3). However, due to the default value of LANGFUSE_DEFAULT_PROJECT_ROLE, that same user may only be created as MEMBER (or VIEWER if explicitly configured) in the default project(3).

The LANGFUSE_DEFAULT_PROJECT_ROLE environment variable defaults to VIEWER if set(1)(2). This means the initialized user gets VIEWER permissions at the project level, preventing them from creating prompts or managing project resources(3).

Solution:

To ensure your initialized admin user has full project permissions, you need to explicitly set the default project role during initialization:

LANGFUSE_DEFAULT_PROJECT_ROLE=OWNER

(1)(2)

The possible values are OWNER, ADMIN, MEMBER, or VIEWER(1)(2).

Important Context:

In Langfuse's RBAC model, organization-level roles do not automatically grant project-level permissions(4). Project-level permissions are checked separately, so even Organization Owners need to be explicitly assigned a project-level role for each project to perform actions like creating prompts(4). This is a known limitation in the current permissions model(4).

As a result, there is no project-level OWNER by default, and nobody can see or manage the project API keys that were seeded using LANGFUSE_INIT_PROJECT_PUBLIC_KEY and LANGFUSE_INIT_PROJECT_SECRET_KEY unless the project role is explicitly set(3).

Resource Dependencies:

The headless initialization resources depend on each other as follows(1)(2):

Organization
├── Project (part of organization)
│   └── API Keys (set for project)
└── User (owner of organization)

(1)(2)

You can initialize an organization and a user without initializing a project and API keys, but you cannot initialize a project without also initializing an organization(1)(2).

📚 Sources:

1. Headless Initialization
2. Deployment Guide (v2)
3. Self-hosted headless initialization
4. bug: Organization Owner does not have permission to perform actions inside their Organization

---

Have another question? Just tag @inkeep.

[soumen-eric]

@Steffen911 ,

Found similar issue #10907 fix earlier , is this understanding correct!

[Steffen911]

@soumen-eric Did you try to apply the inkeep suggestion? Does this address your needs?

[soumen-eric]

Hi @Steffen911

As suggested, I tried the following configuration:

LANGFUSE_DEFAULT_ORG_ROLE=VIEWER
LANGFUSE_DEFAULT_PROJECT_ROLE=MEMBER

With this setup an SSO user is assigned the VIEWER role at the organization level and the MEMBER role at the project level in Langfuse. In this case the user is able to create prompts.

However, my requirement is slightly different. I want the initial (bootstrap) user to have the OWNER role at both the organization and project levels. All other SSO users should by default be assigned the VIEWER role at both the organization and project levels.

also no project level role change option enabled

[Steffen911]

@soumen-eric Glad to hear that this got you closer to the expected state.
Unfortunately, the headless initialization feature does not allow for the more complex scenario you want to cover. Instead, you could try to use our SCIM APIs to provision users with correct roles once you've finished the initial setup: https://langfuse.com/docs/administration/scim-and-org-api#user-management-via-scim.