JuliusBrussee/caveman · critical

cache-replay: ANTHROPIC_API_KEY unavailable

Error message

cache-replay: ANTHROPIC_API_KEY unavailable

What it means

Returned by validateProviderCredentials when the trace contains anthropic requests but ANTHROPIC_API_KEY is empty in the cache-replay process. Same fail-fast pre-flight as the other provider checks: every distinct provider in the trace must have credentials present before live replay starts.

Source

Thrown at cacheengine/cmd/cache-replay/main.go:381

		return nil, "", fmt.Errorf("cache-replay: trace exceeds %d bytes", maxBytes)
	}
	return records, hex.EncodeToString(hash.Sum(nil)), nil
}

func validateProviderCredentials(records []cachebench.TraceRecord) error {
	providers := map[string]bool{}
	for _, record := range records {
		providers[record.Provider] = true
	}
	for provider := range providers {
		switch provider {
		case "openai":
			if os.Getenv("OPENAI_API_KEY") == "" {
				return errors.New("cache-replay: OPENAI_API_KEY unavailable")
			}
		case "anthropic":
			if os.Getenv("ANTHROPIC_API_KEY") == "" {
				return errors.New("cache-replay: ANTHROPIC_API_KEY unavailable")
			}
		case "gemini":
			if os.Getenv("GEMINI_API_KEY") == "" {
				return errors.New("cache-replay: GEMINI_API_KEY unavailable")
			}
		case "bedrock":
			if os.Getenv("AWS_BEARER_TOKEN_BEDROCK") == "" && (os.Getenv("AWS_ACCESS_KEY_ID") == "" || os.Getenv("AWS_SECRET_ACCESS_KEY") == "") {
				return errors.New("cache-replay: Bedrock bearer token or AWS access credentials unavailable")
			}
		default:
			return fmt.Errorf("cache-replay: unsupported provider %q", provider)
		}
	}
	return nil
}

func verifierEnvironment(extra []string) ([]string, error) {
	allowed := map[string]bool{"PATH": true, "LANG": true, "LC_ALL": true, "TMPDIR": true}

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Export ANTHROPIC_API_KEY for the cache-replay process
2. Verify with: printenv ANTHROPIC_API_KEY (check presence, do not log the value)
3. Filter the trace to providers with available credentials if Anthropic replay is not intended

Example fix

# before
cache-replay -execute ...

# after
export ANTHROPIC_API_KEY="$ANTHROPIC_KEY"
cache-replay -execute ...

if providers["anthropic"] && os.Getenv("ANTHROPIC_API_KEY") == "" {
	return errors.New("set ANTHROPIC_API_KEY before live replay")
}

When it happens

Trigger: Trace with provider "anthropic" records and no ANTHROPIC_API_KEY exported to the cache-replay process.

Common situations: Multi-provider traces where only the OpenAI key was configured; secret named differently in the vault (e.g. ANTHROPIC_KEY); keys set in a docker layer but overridden by an empty env entry in compose.

Related errors

• cache-replay: OPENAI_API_KEY unavailable
• cache-replay: GEMINI_API_KEY unavailable
• cache-replay: Bedrock bearer token or AWS access credentials
• no provider credential detected; pass --provider
• multiple provider credentials detected; pass --provider

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/c7945982abf87415. Report an issue: GitHub.