Tencent/WeKnora · error

E2BAPIKey is required for the E2B backend

Error message

E2BAPIKey is required for the E2B backend

What it means

The E2B backend authenticates every envd request with cfg.E2BAPIKey, so newE2BRemoteClient rejects construction when the key is missing or whitespace-only. Unlike a network auth failure, this fires locally at client construction so the misconfiguration is caught before any request is sent.

Source

Thrown at internal/sandbox/e2b_remote_client.go:77

func NewE2BRemoteClientWithPool(
	cfg *Config,
	pool *SandboxGatewayTransportPool,
) (*E2BRemoteClient, error) {
	if pool == nil {
		return newE2BRemoteClient(cfg, nil)
	}
	return newE2BRemoteClient(cfg, pool.RoundTripperFor(cfg))
}

func newE2BRemoteClient(
	cfg *Config,
	transport http.RoundTripper,
) (*E2BRemoteClient, error) {
	if cfg == nil {
		return nil, errors.New("e2b remote client config is required")
	}
	if strings.TrimSpace(cfg.E2BAPIKey) == "" {
		return nil, errors.New("E2BAPIKey is required for the E2B backend")
	}
	timeout := cfg.E2BHTTPTimeout
	if timeout <= 0 {
		timeout = DefaultE2BHTTPTimeout
	}
	// Every E2B client speaks to envd through the compatibility shim, whether
	// or not a gateway is configured: the two details it rewrites belong to the
	// envd protocol itself, not to any one deployment. See envd_compat_transport.go.
	httpClient := &http.Client{
		Timeout:   timeout,
		Transport: NewEnvdCompatTransport(transport, DefaultSandboxExecUser),
	}
	client, err := e2b.NewClient(e2b.ClientConfig{
		APIKey:        cfg.E2BAPIKey,
		APIBaseURL:    strings.TrimSpace(cfg.E2BAPIURL),
		SandboxDomain: strings.TrimSpace(cfg.E2BSandboxDomain),
		HTTPClient:    httpClient,
	})

View on GitHub (pinned to 988cbb0330)

Solutions

1. Set cfg.E2BAPIKey (e.g. from the E2B_API_KEY environment variable) before constructing the client
2. Verify the secret is actually present in the environment/secret manager at runtime (echo presence, not value)
3. Check for key-name typos or whitespace-only values in config files

Example fix

// before
cfg := &sandbox.Config{} // E2BAPIKey empty
// after
key := os.Getenv("E2B_API_KEY")
if key == "" {
    return nil, errors.New("E2B_API_KEY not set")
}
cfg := &sandbox.Config{E2BAPIKey: key}

if strings.TrimSpace(cfg.E2BAPIKey) == "" {
    return errors.New("E2B_API_KEY must be set before constructing the E2B client")
}

func hasE2BAPIKey(cfg *sandbox.Config) bool {
    return cfg != nil && strings.TrimSpace(cfg.E2BAPIKey) != ""
}

When it happens

Trigger: Calling NewE2BRemoteClientWithTransport or NewE2BRemoteClientWithPool with a Config whose E2BAPIKey is "" or only whitespace (TrimSpace is applied).

Common situations: E2B_API_KEY environment variable not set in CI or a fresh checkout; secret manager injection failed; key set under a different env var name after a rename; expired credentials removed from config.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• e2b remote client config is required
• sandbox: remote sandbox has no template configured
• sandbox: docker client requires a config
• sandbox: docker backend requires an image
• E2B timeout must be at least one second

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/253fa35e3504c5e1. Report an issue: GitHub.