Significant-Gravitas/AutoGPT · error · HTTPException

API key not found

Error message

API key not found

What it means

API-key endpoint returns 404 when `api_key_db.get_api_key_by_id(key_id, user_id, organization_id=ctx.org_id or None)` finds nothing: the lookup is scoped by user and (when the request context carries one) organization, so a key ID that exists under a different user/org pairing — or not at all — yields this 404.

Source

Thrown at autogpt_platform/backend/backend/api/features/v1.py:2849

@v1_router.get(
    "/api-keys/{key_id}",
    summary="Get specific API key",
    tags=["api-keys"],
    dependencies=[Security(requires_user)],
)
async def get_api_key(
    key_id: str,
    user_id: Annotated[str, Security(get_user_id)],
    ctx: Annotated[RequestContext, Security(get_request_context)],
) -> api_key_db.APIKeyInfo:
    """Get a specific API key"""
    api_key = await api_key_db.get_api_key_by_id(
        key_id, user_id, organization_id=ctx.org_id or None
    )
    if not api_key:
        raise HTTPException(status_code=404, detail="API key not found")
    return api_key


@v1_router.delete(
    "/api-keys/{key_id}",
    summary="Revoke API key",
    tags=["api-keys"],
    dependencies=[Security(requires_user)],
)
async def delete_api_key(
    key_id: str,
    user_id: Annotated[str, Security(get_user_id)],
    ctx: Annotated[RequestContext, Security(get_request_context)],
) -> api_key_db.APIKeyInfo:
    """Revoke an API key"""
    return await api_key_db.revoke_api_key(
        key_id, user_id, organization_id=ctx.org_id or None
    )

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Re-list keys (GET /api-keys) and confirm key_id is present for the current user + organization.
2. If the org context changed, re-issue the request under the organization the key was created in.
3. Drop cached key details after revocation.

const keys = await api.listApiKeys();
const key = keys.find(k => k.id === keyId && k.orgId === activeOrgId);
if (!key) { await refreshKeys(); return; }

function isKeyInScope(k: APIKeyInfo | undefined, userId: string, orgId?: string | null): boolean {
  return !!k && k.userId === userId && (!orgId || k.orgId === orgId);
}

try {
  return await api.getApiKey(keyId);
} catch (e) {
  if (e.status === 404) { await refreshKeys(); return null; }
  throw e;
}

When it happens

Trigger: GET /api-keys/{key_id} with a revoked/deleted key ID, a key created under a different organization than the request's active org, or a key owned by another user.

Common situations: Viewing a key detail after revoking it elsewhere; switching organization context in the UI while holding a key_id from the previous org; stale bookmarks/fetches referencing keys purged after revocation.

Related errors

• Execution {execution_id} not found for user {user_id}
• Graph #{graph_id} v{schedule_params.graph_version} not found
• Unsupported import in artifact preview: ${name}
• Failed to fetch artifact
• Graph execution #{graph_exec_id} not found.

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/3411b967752ff896. Report an issue: GitHub.