Tencent/WeKnora · error

credential verification failed: %w

Error message

credential verification failed: %w

What it means

After basic field checks, SaveCredentials verifies the APPID/APPSECRET pair against the WeKnora Cloud health endpoint via verifyCredentials. If verification returns any error (bad request, unreachable service, bad credentials, bad status), it is wrapped as 'credential verification failed: %w' preserving the cause.

Source

Thrown at internal/application/service/weknoracloud.go:46

		tenantRepo: tenantRepo,
	}
}

func IsWeKnoraCloudDocReaderAddr(addr string) bool {
	return strings.TrimSuffix(strings.TrimSpace(addr), "/") == strings.TrimRight(provider.WeKnoraCloudBaseURL, "/")+"/api/v1/doc/reader"
}

// SaveCredentials 仅保存 APPID/APPSECRET 凭证，不自动创建模型
func (s *weKnoraCloudService) SaveCredentials(ctx context.Context, appID, appSecret string) error {
	if appID == "" {
		return fmt.Errorf("app_id is required")
	}
	if appSecret == "" {
		return fmt.Errorf("app_secret is required")
	}

	if err := s.verifyCredentials(ctx, appID, appSecret); err != nil {
		return fmt.Errorf("credential verification failed: %w", err)
	}

	tenantID := types.MustTenantIDFromContext(ctx)
	return s.updateTenantCredentials(ctx, tenantID, appID, appSecret)
}

// verifyCredentials 向 WeKnoraCloud /api/v1/health 发送带签名头的 GET。
//
// 注意：health 一般为探活接口，远端常不校验 APPID/SECRET 或签名；HTTP 200 通常只表示
// 「网关/服务可达」，不能严格证明凭证有效。若需强校验，应改为调用必须鉴权的业务接口。
func (s *weKnoraCloudService) verifyCredentials(ctx context.Context, appID, appSecret string) error {
	baseURL := strings.TrimRight(provider.WeKnoraCloudBaseURL, "/")
	healthURL := baseURL + "/api/v1/health"

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, healthURL, nil)
	if err != nil {
		return fmt.Errorf("create verification request failed: %w", err)
	}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Inspect the wrapped %w cause in the error chain (errors.Unwrap / %v output) to see which sub-failure occurred.
2. Confirm APPID/APPSECRET are correct by re-entering them from the WeKnora Cloud console.
3. Verify provider.WeKnoraCloudBaseURL points at the correct reachable instance (curl the /api/v1/health path).
4. Check network egress/proxy rules allow the app to reach the cloud base URL.
5. If signature headers are involved, confirm server clocks are NTP-synced and the Sign helper matches the server's expected scheme.

Example fix

// before
if err := svc.SaveCredentials(ctx, appID, appSecret); err != nil { log.Println(err) }
// after
if err := svc.SaveCredentials(ctx, appID, appSecret); err != nil {
	log.Printf("save failed: %v (cause: %v)", err, errors.Unwrap(err))
}

if err := svc.SaveCredentials(ctx, appID, appSecret); err != nil {
	var cause error
	if errors.As(err, &cause) || (cause = errors.Unwrap(err)) != nil {
		switch {
		case strings.Contains(cause.Error(), "unreachable"):
			// network path
		case strings.Contains(cause.Error(), "invalid APPID"):
			// credentials path
		}
	}
	return err
}

When it happens

Trigger: SaveCredentials called with non-empty credentials that fail verification: http.NewRequestWithContext error, network/SSRF-safe client failure (service unreachable), HTTP 401/403, or non-200 status from the health endpoint.

Common situations: Typo'd APPID/APPSECRET; WeKnora Cloud instance down or wrong base URL; corporate proxy blocking outbound HTTPS; clock/signature mismatch if the Sign helper produces invalid headers.

Related errors

• app_id is required
• app_secret is required
• create verification request failed: %w
• service unreachable: %w
• invalid APPID or APPSECRET (HTTP %d)

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/9835314668db7846. Report an issue: GitHub.