FlowiseAI/Flowise · error · Error

Failed to retrieve secret value.

Error message

Failed to retrieve secret value.

What it means

Thrown inside the AWS Secrets Manager branch of decryptCredentialData when GetSecretValueCommand succeeds but response.SecretString is null/undefined/empty. This happens when the secret is stored as binary (SecretBinary) rather than a string, or the secret was deleted/rotated and the ARN/ID no longer points at a string-valued version.

Source

Thrown at packages/components/src/utils.ts:621

 * @param {string} encryptedData
 * @param {string} componentCredentialName
 * @param {IComponentCredentials} componentCredentials
 * @returns {Promise<ICommonObject>}
 */
export const decryptCredentialData = async (encryptedData: string): Promise<ICommonObject> => {
    let decryptedDataStr: string

    if (USE_AWS_SECRETS_MANAGER && secretsManagerClient) {
        try {
            if (encryptedData.startsWith('FlowiseCredential_')) {
                const command = new GetSecretValueCommand({ SecretId: encryptedData })
                const response = await secretsManagerClient.send(command)

                if (response.SecretString) {
                    const secretObj = JSON.parse(response.SecretString)
                    decryptedDataStr = JSON.stringify(secretObj)
                } else {
                    throw new Error('Failed to retrieve secret value.')
                }
            } else {
                const encryptKey = await getEncryptionKey()
                const decryptedData = AES.decrypt(encryptedData, encryptKey)
                decryptedDataStr = decryptedData.toString(enc.Utf8)
            }
        } catch (error) {
            console.error(error)
            throw new Error('Failed to decrypt credential data.')
        }
    } else {
        // Fallback to existing code
        const encryptKey = await getEncryptionKey()
        const decryptedData = AES.decrypt(encryptedData, encryptKey)
        decryptedDataStr = decryptedData.toString(enc.Utf8)
    }

    if (!decryptedDataStr) return {}

View on GitHub (pinned to abe4a8601a)

Solutions

1. Inspect the secret in AWS console/CLI: aws secretsmanager get-secret-value --secret-id <FlowiseCredential_...> and confirm SecretString is populated.
2. If the secret is binary, re-store it as a JSON string matching the expected credential shape.
3. Verify the IAM role Flowise runs under has secretsmanager:GetSecretValue on that ARN.
4. Confirm the FlowiseCredential_ prefix convention is intact and the secret ID passed matches the real ARN/name.

Example fix

// before
const response = await secretsManagerClient.send(command)
if (response.SecretString) {
  const secretObj = JSON.parse(response.SecretString)
  decryptedDataStr = JSON.stringify(secretObj)
} else {
  throw new Error('Failed to retrieve secret value.')
}

// after — handle binary secret and surface AWS context
const response = await secretsManagerClient.send(command)
if (response.SecretString) {
  decryptedDataStr = response.SecretString
} else if (response.SecretBinary) {
  const b64 = typeof response.SecretBinary === 'string' ? response.SecretBinary : response.SecretBinary.toString('base64')
  decryptedDataStr = Buffer.from(b64, 'base64').toString('utf8')
} else {
  throw new Error(`Failed to retrieve secret value for ${encryptedData}: secret has neither SecretString nor SecretBinary`)
}

async function secretHasString(client: SecretsManagerClient, id: string): Promise<boolean> {
  try {
    const r = await client.send(new GetSecretValueCommand({ SecretId: id }))
    return typeof r.SecretString === 'string' && r.SecretString.length > 0
  } catch {
    return false
  }
}

function hasSecretString(r: GetSecretValueCommandOutput): r is GetSecretValueCommandOutput & { SecretString: string } {
  return typeof r.SecretString === 'string' && r.SecretString.length > 0
}

try {
  const response = await secretsManagerClient.send(new GetSecretValueCommand({ SecretId: encryptedData }))
  if (!hasSecretString(response)) throw new Error('Failed to retrieve secret value.')
  decryptedDataStr = response.SecretString
} catch (err) {
  throw new Error(`Secret retrieval failed for ${encryptedData}: ${err instanceof Error ? err.message : String(err)}`)
}

When it happens

Trigger: The FlowiseCredential_<id> secret in AWS Secrets Manager was created with binary data instead of a JSON string; the secret version was rotated to a binary stage; IAM grants read but the secret's only payload is in SecretBinary; the secret was partially deleted leaving an empty string stage.

Common situations: Importing credentials via infrastructure-as-code that writes binary blobs; AWS rotation lambda that switches to binary encoding; cross-account secret sharing where the KMS key decrypts but the payload is binary; migrating from local AES to Secrets Manager with a malformed payload.

Related errors

• Failed to decrypt credential data.
• OpenAI ApiKey not found
• Firecrawl API key not set. You can set it as FIRECRAWL_API_K
• Azure Foundry API Key is missing in credentials.
• Azure Foundry Endpoint is missing in credentials.

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b5c162449fdab6ed. Report an issue: GitHub.