DNS automated resolution failed: APIKey or APISecret is empt

Error message

DNS automated resolution failed: APIKey or APISecret is empty in Godaddy configuration file

What it means

SetDnsGodaddy pre-validates its keyConfig map before constructing the lego GoDaddy DNS provider. GoDaddy's API authenticates with an API key/secret pair (HTTP signature), so if keyConfig is nil or APIKey or APISecret is empty, the function fails fast with this fixed message.

Source

Thrown at core/internal/service/acme/acme.go:271

	}

	err = client.Challenge.SetDNS01Provider(p)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS verification setup failed: {}", err.Error()))
	}

	return nil
}

/**
 * @description: Configure DNS verification via GoDaddy
 * @param {*lego.Client} client Client
 * @param {map[string]string} keyConfig Configuration information
 * @return error Error information
 */
func SetDnsGodaddy(ctx context.Context, client *lego.Client, keyConfig map[string]string) error {
	if keyConfig == nil || keyConfig["APIKey"] == "" || keyConfig["APISecret"] == "" {
		return errors.New(public.LangCtx(ctx, "DNS automated resolution failed: APIKey or APISecret is empty in Godaddy configuration file"))
	}

	cfg := godaddy.NewDefaultConfig()
	cfg.APIKey = keyConfig["APIKey"]
	cfg.APISecret = keyConfig["APISecret"]

	p, err := godaddy.NewDNSProviderConfig(cfg)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS provider initialization failed: {}", err.Error()))
	}

	err = client.Challenge.SetDNS01Provider(p)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS verification setup failed: {}", err.Error()))
	}

	return nil
}

View on GitHub (pinned to fc36c76c05)

Solutions

Provide both APIKey and APISecret from the GoDaddy Developer Portal (API Keys section).
Check the config keys are named exactly APIKey and APISecret (case-sensitive).
Trim quotes, spaces, and newlines from pasted values.
Regenerate the key pair if the old one was revoked or expired.

Example fix

// before
keyConfig := map[string]string{"APIKey": apiKey} // APISecret missing
err := SetDnsGodaddy(ctx, client, keyConfig)
// after
keyConfig := map[string]string{"APIKey": apiKey, "APISecret": apiSecret}
err := SetDnsGodaddy(ctx, client, keyConfig)

Defensive patterns

Strategy: validation

Validate before calling

func goDaddyConfigReady(kc map[string]string) bool {
    return kc != nil && strings.TrimSpace(kc["APIKey"]) != "" && strings.TrimSpace(kc["APISecret"]) != ""
}

Type guard

func hasGoDaddyKeys(kc map[string]string) bool {
    return kc != nil && kc["APIKey"] != "" && kc["APISecret"] != ""
}

Try / catch

if err := SetDnsGodaddy(ctx, client, tokens); err != nil {
    if strings.Contains(err.Error(), "APISecret") {
        return errors.New("GoDaddy API key pair incomplete — supply both APIKey and APISecret")
    }
    return err
}

Prevention

Treat APIKey and APISecret as a mandatory pair in the provider config form.
Reject misspelled keys (api_key, secret) with a schema validation on config load.
Trim whitespace and strip surrounding quotes from pasted credentials.
Use production keys, not OTE test keys.

When it happens

Trigger: ApplySSLWithExistingServer with vtype="dns" and dnsProvider="godaddy" where the token map lacks APIKey or APISecret, or is entirely nil.

Common situations: Users enter only the key and forget the secret (GoDaddy's UI produces both); the JSON config keys are misspelled (e.g. "api_key") so map lookups return empty strings; a GoDaddy API key was revoked and the reissued one was stored under the wrong field.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/020ecce9944f5e5f. Report an issue: GitHub.