Tencent/WeKnora · error

invalid APPID or APPSECRET (HTTP %d)

Error message

invalid APPID or APPSECRET (HTTP %d)

What it means

When the WeKnora Cloud health endpoint responds with HTTP 401 or 403, verifyCredentials concludes the APPID/APPSECRET pair is invalid and returns 'invalid APPID or APPSECRET (HTTP %d)'. This is an application-level rejection of the credentials, not a transport failure.

Source

Thrown at internal/application/service/weknoracloud.go:86

	for k, v := range signHeaders {
		req.Header.Set(k, v)
	}

	logger.Infof(ctx, "credential verification request: method=GET url=%s app_id=%s request_id=%s ",
		healthURL, appID, requestID)

	clientCfg := utils.DefaultSSRFSafeHTTPClientConfig()
	clientCfg.Timeout = 10 * time.Second
	client := utils.NewSSRFSafeHTTPClient(clientCfg)
	resp, err := client.Do(req)
	if err != nil {
		logger.Warnf(ctx, "credential verification HTTP failed: url=%s err=%v", healthURL, err)
		return fmt.Errorf("service unreachable: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
		return fmt.Errorf("invalid APPID or APPSECRET (HTTP %d)", resp.StatusCode)
	}
	if resp.StatusCode != http.StatusOK {
		return fmt.Errorf("invalid response status code: %d", resp.StatusCode)
	}
	return nil
}

// CheckStatus 检查 WeKnoraCloud 凭证是否可正常解密
func (s *weKnoraCloudService) CheckStatus(ctx context.Context) (*types.WeKnoraCloudStatusResult, error) {
	tenantID := types.MustTenantIDFromContext(ctx)

	tenant, err := s.tenantRepo.GetTenantByID(ctx, tenantID)
	if err != nil || tenant == nil {
		return &types.WeKnoraCloudStatusResult{HasModels: false, NeedsReinit: false}, nil
	}

	creds := tenant.Credentials.GetWeKnoraCloud()
	if creds == nil {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Re-enter APPID and APPSECRET exactly as issued (watch for trailing whitespace/newlines).
2. Regenerate credentials in the WeKnora Cloud console if they may have been revoked or rotated.
3. Confirm the Sign helper's headers and requestID format match what the server currently expects (check for version drift).
4. Verify you're authenticating against the correct environment (staging credentials vs production base URL).
5. If 403 persists with valid-looking credentials, check IP allowlisting or permission scope on the cloud side.

Example fix

// before
appSecret := "sk-abc123 " // trailing space/newline from paste
// after
appSecret := strings.TrimSpace(cfg.AppSecret)
if err := svc.SaveCredentials(ctx, strings.TrimSpace(appID), appSecret); err != nil { ... }

if strings.TrimSpace(appID) == "" || strings.TrimSpace(appSecret) == "" {
	return errors.New("APPID and APPSECRET must be non-empty")
}
// optionally pre-verify against /api/v1/health with the same Sign headers before save

if err := svc.SaveCredentials(ctx, appID, appSecret); err != nil {
	if strings.Contains(err.Error(), "invalid APPID or APPSECRET") {
		// do not retry with same creds; prompt user to re-enter them
		return reauthError(err)
	}
	return err
}

When it happens

Trigger: SaveCredentials called with credentials the server rejects: wrong APPID, wrong APPSECRET, revoked/expired credentials, or signature headers (modelsutils.Sign with a generated requestID) the server refuses to authenticate.

Common situations: Copy-paste errors introducing whitespace or truncating the secret; credentials rotated on the server side while the app still holds old ones; signing scheme/requestID format mismatch after a server upgrade; using credentials from a different WeKnora Cloud tenant.

Related errors

• app_id is required
• app_secret is required
• credential verification failed: %w
• empty qqbot access token: code=%d message=%s
• OIDC provider returned no user claims

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/7fbdfe2e4c757b62. Report an issue: GitHub.