Mintplex-Labs/anything-llm · error

No valid API key found.

Error message

No valid API key found.

What it means

Auth guard in the validBrowserExtensionApiKey middleware: the Authorization header is missing or malformed (no bearer segment), so there is no browser-extension API key to validate and the request is refused with 403.

Source

Thrown at server/utils/middleware/validBrowserExtensionApiKey.js:14

const {
  BrowserExtensionApiKey,
} = require("../../models/browserExtensionApiKey");
const { SystemSettings } = require("../../models/systemSettings");
const { User } = require("../../models/user");

async function validBrowserExtensionApiKey(request, response, next) {
  const multiUserMode = await SystemSettings.isMultiUserMode();
  response.locals.multiUserMode = multiUserMode;

  const auth = request.header("Authorization");
  const bearerKey = auth ? auth.split(" ")[1] : null;
  if (!bearerKey) {
    response.status(403).json({
      error: "No valid API key found.",
    });
    return;
  }

  const apiKey = await BrowserExtensionApiKey.validate(bearerKey);
  if (!apiKey) {
    response.status(403).json({
      error: "No valid API key found.",
    });
    return;
  }

  if (multiUserMode) {
    const user = await User.get({ id: apiKey.user_id });
    if (!user) {
      response.status(403).json({
        error: "User not found.",

View on GitHub (pinned to 3aec848f28)

Solutions

1. Send the browser extension API key as a Bearer token in the Authorization header.
2. Create a valid browser extension API key via the extension connection flow and retry.

When it happens

Trigger: Browser extension request made without a valid API key. Triggered when validBrowserExtensionApiKey middleware cannot validate the provided key (validBrowserExtensionApiKey.js:14).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/ea802f6b2ed8176d. Report an issue: GitHub.