FlowiseAI/Flowise · warning · InternalFlowiseError

Error: apikeyController.verifyApiKey - apikey not provided!

Error message

Error: apikeyController.verifyApiKey - apikey not provided!

What it means

Thrown by apikeyController.verifyApiKey with HTTP 412 when req.params is undefined or req.params.apikey is falsy. Unlike the other apikey handlers, verifyApiKey is NOT mounted under /apikey — it is registered in routes/verify/index.ts:6 as GET ['/apikey/', '/apikey/:apikey'] on the verify router, i.e. GET /api/v1/verify/apikey/<apikey>. So the path parameter expected is named apikey, not id.

Source

Thrown at packages/server/src/controllers/apikey/index.ts:96

    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.deleteApiKey - id not provided!`)
        }
        if (!req.user?.activeWorkspaceId) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Workspace ID is required`)
        }
        const apiResponse = await apikeyService.deleteApiKey(req.params.id, req.user?.activeWorkspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Verify api key
const verifyApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.apikey) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.verifyApiKey - apikey not provided!`)
        }
        const apiResponse = await apikeyService.verifyApiKey(req.params.apikey)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

export default {
    createApiKey,
    deleteApiKey,
    getAllApiKeys,
    updateApiKey,
    verifyApiKey
}

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Call GET /api/v1/verify/apikey/<apikey> with the literal key value in the final segment.
  2. Guard the key client-side: skip the call when the key is empty/blank.
  3. Use the correct path (/verify/apikey/:apikey), not /apikey/verify.

Example fix

// before
await fetch(`${BASE}/api/v1/apikey/verify/`, { headers })

// after
if (!apikey) throw new Error('apikey required')
await fetch(`${BASE}/api/v1/verify/apikey/${encodeURIComponent(apikey)}`, { headers })
Defensive patterns

Strategy: validation

Validate before calling

function assertApiKey(key: unknown): string {
  if (typeof key !== 'string' || key.trim() === '') {
    throw new Error('apikey is required for verification')
  }
  return key
}
const key = assertApiKey(rawKey)
await fetch(`${BASE}/api/v1/verify/apikey/${encodeURIComponent(key)}`, { headers })

Type guard

const isNonEmptyString = (v: unknown): v is string =>
  typeof v === 'string' && v.trim().length > 0

Prevention

When it happens

Trigger: Calling GET /api/v1/verify/apikey/ (root form, no key segment). A client that hits the wrong base (e.g. /api/v1/apikey/verify/) gets a 404 from Express, not this error. A caller verifying a key before the user has entered it, building the URL from an empty variable.

Common situations: An SDK or browser extension that validates a pasted API key but runs the check while the input field is still empty. A smoke-test script that verifies a key read from an env var that was not set. Confusing this endpoint with a /apikey/verify path (it lives under /verify/apikey).

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b165112c3c010492. Report an issue: GitHub.