What causes "kms: invalid API base URL" in JuliusBrussee/caveman?

Include the scheme: use "https://..." (or "http://" only for local testing)

kms: invalid API base URL

Error message

kms: invalid API base URL

What it means

New parses the configured Scaleway KMS API base URL and rejects any URL that fails url.Parse, lacks a scheme or host, or carries userinfo, a query string, or a fragment. Only clean absolute http(s) base URLs are accepted.

Solutions

Include the scheme: use "https://..." (or "http://" only for local testing)
Remove any query string, fragment, and user info from the base URL
If overriding for tests, use e.g. httptest server URL as-is: srv.URL already includes the scheme and host

Example fix

// before
cfg := kms.Config{APIBaseURL: "api.scaleway.com?debug=1"}
// after
cfg := kms.Config{APIBaseURL: "https://api.scaleway.com"}

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(cfg.APIBaseURL)
if err != nil || u.Scheme == "" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
	return fmt.Errorf("invalid APIBaseURL: %q", cfg.APIBaseURL)
}

Prevention

Always include scheme and host in base URLs
Never append query strings or credentials to a base URL
For tests, use httptest.NewServer(...).URL directly

When it happens

Trigger: Passing Config.APIBaseURL set to something like "localhost:8080" (no scheme), "https://api.example.com/path?x=1" (query), "https://user:pass@host" (userinfo), or a URL with "#fragment".

Common situations: Pointing the client at a local mock server with a scheme-less URL, appending query params for debugging, proxy configuration mistakes, or typos in the override base URL.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/91efa99b8e10c4bf. Report an issue: GitHub.

Appendix: source

Thrown at shared/platform/kms/kms.go:102

	decryptKeyIDs := map[string]struct{}{keyID: {}}
	for _, allowedKeyID := range cfg.AllowedDecryptKeyIDs {
		allowedKeyID = strings.TrimSpace(allowedKeyID)
		if err := validateLocation(region, allowedKeyID); err != nil {
			return nil, err
		}
		decryptKeyIDs[allowedKeyID] = struct{}{}
	}
	token := strings.TrimSpace(cfg.AuthToken)
	if len(token) < 20 {
		return nil, errors.New("kms: auth token is required")
	}
	baseURL := strings.TrimRight(strings.TrimSpace(cfg.APIBaseURL), "/")
	if baseURL == "" {
		baseURL = scalewayAPI
	}
	parsed, err := url.Parse(baseURL)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
		return nil, errors.New("kms: invalid API base URL")
	}
	client := cfg.HTTPClient
	if client == nil {
		client = &http.Client{
			Timeout: 8 * time.Second,
			CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
				return http.ErrUseLastResponse
			},
		}
	}
	return &Client{provider: provider, region: region, keyID: keyID, token: token, apiBaseURL: baseURL, httpClient: client, decryptKeyIDs: decryptKeyIDs}, nil
}

// FromEnvironment loads production configuration. Endpoint is not configurable,
// preventing env-driven host redirection of KMS credentials.
func FromEnvironment() (*Client, error) {
	return fromEnvironment(SecretsKeyEnvironment)
}

View on GitHub (pinned to 3ee70a1026)