TencentCloud/TencentDB-Agent-Memory · error · LlmProviderResolveError

memory 系统用户 key 必须匹配 sk-mem-[A-Za-z0-9_-]{32}

Error message

memory 系统用户 key 必须匹配 sk-mem-[A-Za-z0-9_-]{32}

What it means

When TDAI_MEMORY_SYSTEM_USER_KEY is present in proxy mode, it must match the regex ^sk-mem-[A-Za-z0-9_-]{32}$ (sk-mem- prefix plus exactly 32 chars from [A-Za-z0-9_-]). This error is thrown when the key exists but is malformed, indicating a wrong value rather than a missing one.

Source

Thrown at MemoryCore/src/adapters/standalone/llm-provider-resolver.ts:62

  }
  if (!instanceId || !instanceId.trim()) {
    throw new LlmProviderResolveError(
      "llm.provider=proxy 需要非空 instanceId，无法拼出 /proxy/<iid>/v1 路径",
    );
  }

  const useSystemUserKey = llm.proxy?.useMemorySystemUserKey ?? true;
  let effectiveApiKey = llm.apiKey;
  if (useSystemUserKey) {
    const envKey = process.env.TDAI_MEMORY_SYSTEM_USER_KEY?.trim();
    if (!envKey) {
      throw new LlmProviderResolveError(
        "llm.provider=proxy 需要 memory 系统用户 key —— " +
        "请在 yaml metadata.systemUser.memory 或 env TDAI_MEMORY_SYSTEM_USER_KEY 配置",
      );
    }
    if (!MEMORY_USER_KEY_RE.test(envKey)) {
      throw new LlmProviderResolveError(
        "memory 系统用户 key 必须匹配 sk-mem-[A-Za-z0-9_-]{32}",
      );
    }
    effectiveApiKey = envKey;
  }

  if (!effectiveApiKey) {
    throw new LlmProviderResolveError(
      "llm.provider=proxy 且 useMemorySystemUserKey=false 时必须显式 llm.apiKey",
    );
  }

  const cleanBase = llm.baseUrl.replace(/\/+$/, "");
  return {
    ...llm,
    baseUrl: `${cleanBase}/proxy/${encodeURIComponent(instanceId)}/v1`,
    apiKey: effectiveApiKey,
  };

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Regenerate/copy the correct memory system user key (sk-mem- + 32 chars) and set it in TDAI_MEMORY_SYSTEM_USER_KEY
2. Validate the key locally: node -e 'console.log(/^sk-mem-[A-Za-z0-9_-]{32}$/.test(process.env.TDAI_MEMORY_SYSTEM_USER_KEY))'
3. Check for secret-manager injection issues (trailing newline stripped after trim, so look for truncation instead)
4. Alternatively bypass the check with useMemorySystemUserKey=false plus an explicit llm.apiKey

Example fix

// before
TDAI_MEMORY_SYSTEM_USER_KEY=sk-proj-abc123
// after
TDAI_MEMORY_SYSTEM_USER_KEY=sk-mem-0123456789abcdef0123456789abcdef

const MEMORY_USER_KEY_RE = /^sk-mem-[A-Za-z0-9_-]{32}$/;
function isValidMemoryUserKey(k) {
  return typeof k === "string" && MEMORY_USER_KEY_RE.test(k);
}

function isMemoryUserKey(v) {
  return typeof v === "string" && /^sk-mem-[A-Za-z0-9_-]{32}$/.test(v);
}

try {
  const runtimeLlm = resolveStandaloneLlmForRuntime(llm, instanceId);
} catch (e) {
  if (e instanceof LlmProviderResolveError && e.message.includes("sk-mem-")) {
    logger.error("TDAI_MEMORY_SYSTEM_USER_KEY has wrong format; expected sk-mem-<32 chars>");
  }
  throw e;
}

When it happens

Trigger: provider="proxy", useMemorySystemUserKey true (default), TDAI_MEMORY_SYSTEM_USER_KEY set but not matching the sk-mem-[A-Za-z0-9_-]{32} pattern (wrong prefix, wrong length, invalid characters, surrounding whitespace already trimmed).

Common situations: Pasting an OpenAI-style sk-... key instead of a memory system user key; truncating or copy-paste truncating the key; using a JWT or other token format; quoting/newline issues when injecting via secret manager.

Related errors

• llm.provider=proxy 且 useMemorySystemUserKey=false 时必须显式 llm.
• llm.provider=proxy 需要 memory 系统用户 key —— 请在 yaml metadata.sy
• metadata.systemUser.memory.userKey 必须匹配 sk-mem-[A-Za-z0-9_-]
• Generation log object key exceeds COS limit
• Invalid generation log key

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/32c3a61d91d4d85b. Report an issue: GitHub.