SigNoz/signoz · error

api_key_expired

api_key_expired

Error message

api key has been expired

What it means

FactorAPIKey.IsExpired returns this error (type Unauthenticated) when the current time is past the key's ExpiresAt unix timestamp. A zero ExpiresAt means the key never expires and returns nil. Callers treat this as authentication failure.

Source

Thrown at pkg/types/serviceaccounttypes/factor_api_key.go:101

		},
		Key: key,
	}
}

func (apiKey *FactorAPIKey) Update(name string, expiresAt uint64) error {
	apiKey.Name = name
	apiKey.ExpiresAt = expiresAt
	apiKey.UpdatedAt = time.Now()
	return nil
}

func (apiKey *FactorAPIKey) IsExpired() error {
	if apiKey.ExpiresAt == 0 {
		return nil
	}

	if time.Now().After(time.Unix(int64(apiKey.ExpiresAt), 0)) {
		return errors.New(errors.TypeUnauthenticated, ErrCodeAPIKeyExpired, "api key has been expired")
	}

	return nil
}

func (key *PostableFactorAPIKey) UnmarshalJSON(data []byte) error {
	type Alias PostableFactorAPIKey

	var temp Alias
	if err := json.Unmarshal(data, &temp); err != nil {
		return err
	}

	if match := factorAPIKeyNameRegex.MatchString(temp.Name); !match {
		return errInvalidAPIKeyName
	}

	if temp.ExpiresAt != 0 && time.Now().After(time.Unix(int64(temp.ExpiresAt), 0)) {

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Generate a new API key and update the credential in your config/env
2. If keys should not expire, create them with no expiry (ExpiresAt=0)
3. Set up rotation before expiry with reminders at 80% TTL
4. Check server clock skew if you believe the key is still valid

Example fix

// before
SIGNOZ_API_KEY=expired-key-01HX...
# after (rotate)
signoz api-key create --name ci-key --expires-in 720h
SIGNOZ_API_KEY=<new-key>

const exp = key.expires_at; // unix seconds
if (exp && Date.now()/1000 > exp) throw new Error('rotate key: expired');

function keyUsable(k: {expires_at:number}): boolean { return !k.expires_at || Date.now()/1000 < k.expires_at; }

if err := apiKey.IsExpired(); err != nil { rotateKey(); retry request with new key }

When it happens

Trigger: Authenticating with an API key whose expires_at timestamp is in the past — any request using that key for auth is rejected as unauthenticated.

Common situations: Keys created with short TTLs for testing left in configs; expired keys after rotation policies; clock drift where the server is ahead; long-lived CI jobs using aged keys.

Related errors

• CodeInvalidInput
• ErrCodeIncorrectPassword
• api_key_invalid_input
• errors.CodeUnauthenticated
• errors.CodeUnauthenticated

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/bc59f06760f7b9d8. Report an issue: GitHub.