diff --git a/api/app_factory.py b/api/app_factory.py
index 3103882ffc..20aa665f94 100644
--- a/api/app_factory.py
+++ b/api/app_factory.py
@@ -15,6 +15,24 @@ from services.feature_service import LicenseStatus
 
 logger = logging.getLogger(__name__)
 
+# Console bootstrap APIs exempt from license check:
+# - system-features: license status for expiry UI (GlobalPublicStoreProvider)
+# - setup: install/setup status check (AppInitializer)
+# - init: init password validation for fresh install (InitPasswordPopup)
+# - login: auto-login after setup completion (InstallForm)
+# - version: version check (AppContextProvider)
+# - activate/check: invitation link validation (signin page)
+# Without these exemptions, the signin page triggers location.reload()
+# on unauthorized_and_force_logout, causing an infinite loop.
+_CONSOLE_EXEMPT_PREFIXES = (
+    "/console/api/system-features",
+    "/console/api/setup",
+    "/console/api/init",
+    "/console/api/login",
+    "/console/api/version",
+    "/console/api/activate/check",
+)
+
 
 # ----------------------------
 # Application Factory Function
@@ -44,27 +62,7 @@ def create_flask_app_with_configs() -> DifyApp:
 
             if is_console_api or is_webapp_api:
                 if is_console_api:
-                    # Console bootstrap APIs exempt from license check:
-                    # - system-features: license status for expiry UI (GlobalPublicStoreProvider)
-                    # - setup: install/setup status check (AppInitializer)
-                    # - init: init password validation for fresh install (InitPasswordPopup)
-                    # - login: auto-login after setup completion (InstallForm)
-                    # - features: billing/plan features (ProviderContextProvider)
-                    # - account/profile: login check + user profile (AppContextProvider, useIsLogin)
-                    # - workspaces/current: workspace + model providers (AppContextProvider)
-                    # - version: version check (AppContextProvider)
-                    # - activate/check: invitation link validation (signin page)
-                    # Without these exemptions, the signin page triggers location.reload()
-                    # on unauthorized_and_force_logout, causing an infinite loop.
-                    console_exempt_prefixes = (
-                        "/console/api/system-features",
-                        "/console/api/setup",
-                        "/console/api/init",
-                        "/console/api/login",
-                        "/console/api/version",
-                        "/console/api/activate/check",
-                    )
-                    is_exempt = any(request.path.startswith(p) for p in console_exempt_prefixes)
+                    is_exempt = any(request.path.startswith(p) for p in _CONSOLE_EXEMPT_PREFIXES)
                 else:  # webapp API
                     is_exempt = request.path.startswith("/api/system-features")