Mintplex-Labs/anything-llm · error

No valid api key found.

Error message

No valid api key found.

What it means

Auth guard in the validApiKey middleware: the Authorization header is missing or contains no bearer token, so there is no API key to validate against the ApiKey table and the request is refused with 403.

Solutions

1. Send the API key as a Bearer token in the Authorization header: 'Authorization: Bearer <key>'.
2. Generate a valid API key in the AnythingLLM API keys settings and use that key.
3. Check the key was not revoked or deleted.

When it happens

Trigger: API request made without a valid API key. Triggered when validApiKey middleware finds no matching key in the Authorization header (validApiKey.js:11).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/5f2f448fd1e7b8a4. Report an issue: GitHub.

Appendix: source

Thrown at server/utils/middleware/validApiKey.js:11

const { ApiKey } = require("../../models/apiKeys");
const { SystemSettings } = require("../../models/systemSettings");

async function validApiKey(request, response, next) {
  const multiUserMode = await SystemSettings.isMultiUserMode();
  response.locals.multiUserMode = multiUserMode;

  const auth = request.header("Authorization");
  const bearerKey = auth ? auth.split(" ")[1] : null;
  if (!bearerKey) {
    response.status(403).json({
      error: "No valid api key found.",
    });
    return;
  }

  if (!(await ApiKey.get({ secret: bearerKey }))) {
    response.status(403).json({
      error: "No valid api key found.",
    });
    return;
  }

  next();
}

module.exports = {
  validApiKey,
};

View on GitHub (pinned to 3aec848f28)