TencentCloud/TencentDB-Agent-Memory · error · LlmResolveError

metadata.systemUser.memory.userKey 必须匹配 sk-mem-[A-Za-z0-9_-]

Error message

metadata.systemUser.memory.userKey 必须匹配 sk-mem-[A-Za-z0-9_-]{32}

What it means

When the memory system user key is used for proxy auth, isValidMemorySystemUserKey enforces the exact format sk-mem-[A-Za-z0-9_-]{32} (prefix "sk-mem-" plus 32 alphanumeric/underscore/hyphen chars). A userKey present but malformed throws this LlmResolveError.

Source

Thrown at MemoryCore/src/gateway/llm-resolver.ts:76

  }
  if (!instanceId || !instanceId.trim()) {
    throw new LlmResolveError(
      "llm.provider=proxy 需要 instanceId，但 core 当前 instanceId 为空 —— " +
      "service 模式下确保请求带 x-tdai-service-id，standalone 模式下确保 yaml 有 instanceId",
    );
  }

  const useSystemUserKey = llm.proxy?.useMemorySystemUserKey ?? true;
  let effectiveApiKey = llm.apiKey;
  if (useSystemUserKey) {
    if (!memorySystemUser) {
      throw new LlmResolveError(
        "llm.provider=proxy 且 llm.proxy.useMemorySystemUserKey=true 需要 " +
        "metadata.systemUser.memory 完整配置（userId + userKey），当前缺失",
      );
    }
    if (!isValidMemorySystemUserKey(memorySystemUser.userKey)) {
      throw new LlmResolveError(
        "metadata.systemUser.memory.userKey 必须匹配 sk-mem-[A-Za-z0-9_-]{32}",
      );
    }
    effectiveApiKey = memorySystemUser.userKey;
  }

  if (!effectiveApiKey) {
    throw new LlmResolveError(
      "llm.provider=proxy 且 useMemorySystemUserKey=false 时必须显式配置 llm.apiKey",
    );
  }

  // baseUrl 拼接规则：去掉尾部斜杠，追加 /proxy/<iid>/v1
  const cleanBase = llm.baseUrl.replace(/\/+$/, "");
  const proxyBaseUrl = `${cleanBase}/proxy/${encodeURIComponent(instanceId)}/v1`;

  return {
    ...llm,

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Generate/obtain a correctly formatted key (sk-mem- + 32 chars of [A-Za-z0-9_-]) and set metadata.systemUser.memory.userKey to it.
2. Trim whitespace/quotes from the yaml value and re-verify length: 7 (prefix) + 32 = 39 chars total.
3. Check for stale legacy keys and rotate to the new sk-mem- format issued by your platform.
4. Alternatively set llm.proxy.useMemorySystemUserKey: false with a valid llm.apiKey to bypass the system-user key path.

Example fix

// before
userKey: sk-abc123
// after
userKey: sk-mem-AbCdEf0123456789AbCdEf0123456789  // 32 chars after sk-mem-

const KEY_RE = /^sk-mem-[A-Za-z0-9_-]{32}$/;
if (!KEY_RE.test(metadata.systemUser?.memory?.userKey ?? '')) {
  throw new Error('metadata.systemUser.memory.userKey must match sk-mem-[A-Za-z0-9_-]{32}');
}

function isValidMemorySystemUserKey(key: unknown): key is string {
  return typeof key === 'string' && /^sk-mem-[A-Za-z0-9_-]{32}$/.test(key);
}

try {
  gateway.start();
} catch (err) {
  if (err instanceof LlmResolveError && err.message.includes('sk-mem-')) {
    console.error('Regenerate the memory userKey in the sk-mem-xxxxxxxx... format (32 chars after prefix)');
  }
  throw err;
}

When it happens

Trigger: metadata.systemUser.memory.userKey set to a generic sk- key, a truncated key, one with invalid characters (spaces, dots), or wrong length (e.g. 16 or 64 chars after the prefix).

Common situations: Pasting a normal OpenAI-style sk- key instead of a memory key; copying the key with surrounding quotes/whitespace or truncation from a terminal; older deployments using a legacy key format before the sk-mem- scheme was introduced.

Related errors

• llm.provider=proxy 且 useMemorySystemUserKey=false 时必须显式 llm.
• memory 系统用户 key 必须匹配 sk-mem-[A-Za-z0-9_-]{32}
• teamId is required for an agent prompt setting
• [skill-worker-pool] concurrency must be positive integer, go
• EmbeddingService: dimensions is required for remote provider

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/a4f5c5c62d2e3c23. Report an issue: GitHub.