FlowiseAI/Flowise · error · InternalFlowiseError

Error: chatflowsController.getChatflowByApiKey - apikey not

Error message

Error: chatflowsController.getChatflowByApiKey - apikey not provided!

What it means

Thrown by getChatflowByApiKey when req.params.apikey is missing. PRECONDITION_FAILED (412) guard before the API-key lookup. Note this is a public-style endpoint that authenticates via the apikey path param itself, not via req.user.

Source

Thrown at packages/server/src/controllers/chatflows/index.ts:111

        const { page, limit } = getPageAndLimitParams(req)

        const apiResponse = await chatflowsService.getAllChatflows(
            req.query?.type as ChatflowType,
            req.user?.activeWorkspaceId,
            page,
            limit
        )
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Get specific chatflow via api key
const getChatflowByApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.apikey) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: chatflowsController.getChatflowByApiKey - apikey not provided!`
            )
        }
        const apikey = await apiKeyService.getApiKey(req.params.apikey)
        if (!apikey) {
            return res.status(401).send('Unauthorized')
        }
        const apiResponse = await chatflowsService.getChatflowByApiKey(apikey.id, apikey.workspaceId, req.query.keyonly)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const getChatflowById = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {

View on GitHub (pinned to abe4a8601a)

Solutions

Ensure the apikey is in the URL path segment the route expects.
Do not send the apikey only as a header or query — the controller reads req.params.apikey.
Validate the key variable is non-empty client-side before calling.

Example fix

// before
await api.get(`/api/v1/chatflows/apikey`)
// after
await api.get(`/api/v1/chatflows/${encodeURIComponent(apikey)}/apikey`)

Defensive patterns

Strategy: validation

Validate before calling

if (!apikey || typeof apikey !== 'string' || apikey.length === 0) {
  throw new Error('apikey path param required')
}

Type guard

function isNonEmptyApikey(v: unknown): v is string {
  return typeof v === 'string' && v.trim().length > 0
}

Prevention

Pass the apikey in the URL path segment the route expects, not only as a header.
URL-encode the apikey when building the path.
Keep auth-by-apikey vs auth-by-JWT endpoints clearly separated in client code.

When it happens

Trigger: Calling the by-api-key endpoint with no apikey segment in the URL; client sent the key as a header/query instead of the path param the route expects.

Common situations: Client confusion between Authorization header and path-param auth; SDK version changed where the key is passed; URL template uses an undefined variable.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/a6f1efa895834c5f. Report an issue: GitHub.