Mintplex-Labs/anything-llm · error · Error

res.statusText || "Error fetching api key."

Error message

res.statusText || "Error fetching api key."

What it means

Thrown by System.getApiKeys on a non-2xx GET to /api/system/api-keys. It prefers res.statusText (the HTTP reason phrase) over the generic 'Error fetching api key.', so the surfaced message is often terse (e.g. 'Unauthorized', 'Forbidden'). The .catch() returns {apiKey:null, error:e.message}.

Source

Thrown at frontend/src/models/system.js:553

      headers: baseHeaders(),
    })
      .then((res) => {
        if (res.ok) return { success: true, error: null };
        throw new Error("Error removing logo!");
      })
      .catch((e) => {
        console.log(e);
        return { success: false, error: e.message };
      });
  },
  getApiKeys: async function () {
    return fetch(`${API_BASE}/system/api-keys`, {
      method: "GET",
      headers: baseHeaders(),
    })
      .then((res) => {
        if (!res.ok) {
          throw new Error(res.statusText || "Error fetching api key.");
        }
        return res.json();
      })
      .catch((e) => {
        console.error(e);
        return { apiKey: null, error: e.message };
      });
  },
  generateApiKey: async function (data = {}) {
    return fetch(`${API_BASE}/system/generate-api-key`, {
      method: "POST",
      headers: baseHeaders(),
      body: JSON.stringify(data),
    })
      .then((res) => {
        if (!res.ok) {
          throw new Error(res.statusText || "Error generating api key.");
        }

View on GitHub (pinned to 526360e320)

Solutions

1. Gate the UI behind an admin/manager role check before calling getApiKeys().
2. Confirm localStorage AUTH_TOKEN is valid (re-check via System.checkAuth).
3. Read res.statusText — 'Unauthorized'/'Forbidden' pinpoints an authz issue.
4. Verify the backend version exposes /system/api-keys.

Example fix

// before
const { apiKey } = await System.getApiKeys();

// after (role-gate + explicit message)
if (!isAdmin()) return;
const res = await System.getApiKeys();
if (res.error) showToast(res.error); // surfaces 'Unauthorized' etc.
else setApiKey(res.apiKey);

function canFetchApiKeys() {
  return isAdmin() && !!window.localStorage.getItem("anythingllm_authToken");
}

/** @param {any} r @returns {r is {apiKey:string|null, error?:string}} */
function isApiKeysResult(r) {
  return r != null && (r.apiKey === null || typeof r.apiKey === "string");
}

if (!canFetchApiKeys()) return;
const res = await System.getApiKeys();
if (!isApiKeysResult(res) || res.error) {
  showToast(res.error || "Could not load API keys");
}

When it happens

Trigger: Calling getApiKeys() when the caller is not an admin/manager (403), when the auth token is expired (401), or when the api-keys table/collection is unavailable (500).

Common situations: A non-admin user opens the API-keys panel; the token expired mid-session; the API-key feature was disabled in this deployment; backend version predates the /system/api-keys route.

Related errors

• ${res.statusText || "Error fetching api keys."}
• ${res.statusText || "Error generating api key."}
• Failed to sync link content. ${reason}
• Failed to sync YouTube video transcript. ${reason}
• Failed to sync Confluence page content. ${reason}

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/23a3a978927e7778. Report an issue: GitHub.