Wei-Shaw/sub2api · error

agent identity private key 格式无效

Error message

agent identity private key 格式无效

What it means

Returned at backend/internal/handler/admin/account_codex_import.go:522 when all four mandatory agent-identity fields are present but service.ValidateOpenAIAgentIdentityPrivateKey rejects the private key string — the key is not parseable as the expected OpenAI agent-identity key format (wrong PEM/encoding, truncated, or corrupted). It wraps the underlying validation failure into a generic Chinese-language message.

Source

Thrown at backend/internal/handler/admin/account_codex_import.go:522

	case map[string]any:
		if agentIdentity, ok := firstCodexMap(raw, []string{"agent_identity"}, []string{"agentIdentity"}); ok || strings.EqualFold(firstCodexString(raw, []string{"auth_mode"}, []string{"authMode"}), service.OpenAIAuthModeAgentIdentity) {
			if !ok {
				agentIdentity = raw
			}
			item.IsAgentIdentity = true
			item.AgentRuntimeID = firstCodexString(agentIdentity, []string{"agent_runtime_id"}, []string{"agentRuntimeId"})
			item.AgentPrivateKey = firstCodexString(agentIdentity, []string{"agent_private_key"}, []string{"agentPrivateKey"})
			item.AgentTaskID = firstCodexString(agentIdentity, []string{"task_id"}, []string{"taskId"})
			item.AccountID = firstCodexString(agentIdentity, []string{"account_id"}, []string{"accountId"})
			item.UserID = firstCodexString(agentIdentity, []string{"chatgpt_user_id"}, []string{"chatgptUserId"})
			item.Email = firstCodexString(agentIdentity, []string{"email"})
			item.PlanType = firstCodexString(agentIdentity, []string{"plan_type"}, []string{"planType"})
			item.AgentFedRAMP = firstCodexBool(agentIdentity, []string{"chatgpt_account_is_fedramp"}, []string{"chatgptAccountIsFedramp"})
			if item.AgentRuntimeID == "" || item.AgentPrivateKey == "" || item.AccountID == "" || item.UserID == "" {
				return nil, errors.New("agent identity 缺少必要字段")
			}
			if err := service.ValidateOpenAIAgentIdentityPrivateKey(item.AgentPrivateKey); err != nil {
				return nil, errors.New("agent identity private key 格式无效")
			}
			item.Credentials["auth_mode"] = service.OpenAIAuthModeAgentIdentity
			item.Credentials["agent_runtime_id"] = item.AgentRuntimeID
			item.Credentials["agent_private_key"] = item.AgentPrivateKey
			item.Credentials["chatgpt_account_id"] = item.AccountID
			item.Credentials["chatgpt_user_id"] = item.UserID
			item.Credentials["chatgpt_account_is_fedramp"] = item.AgentFedRAMP
			setCodexCredentialIfNotEmpty(item.Credentials, "task_id", item.AgentTaskID)
			setCodexCredentialIfNotEmpty(item.Credentials, "email", item.Email)
			setCodexCredentialIfNotEmpty(item.Credentials, "plan_type", item.PlanType)
			if item.AgentTaskID == "" {
				item.WarningTexts = append(item.WarningTexts, "未包含 task_id，首次请求会使用现有 runtime 注册新 task")
			}
			item.IdentityKeys = buildCodexAgentIdentityKeys(item.AccountID)
			item.Name = buildCodexImportAccountName(item, entry.Index)
			return item, nil
		}
		item.AccessToken = firstCodexString(raw,

View on GitHub (pinned to 073e92d171)

Solutions

1. Re-export the agent identity from its source and import the file unmodified rather than copying the key by hand.
2. Verify the key is a complete, valid PEM block (correct BEGIN/END lines, intact base64) before import.
3. Check the JSON file for escaped or doubled newlines inside agent_private_key (e.g. '\n' vs literal newlines) and fix the encoding.
4. Confirm the tool version that produced the key matches the format ValidateOpenAIAgentIdentityPrivateKey expects.

Example fix

// before
"agent_private_key": "-----BEGIN PRIVATE KEY----- MIIEv... (single line, newlines stripped)

// after
"agent_private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADAN...\n-----END PRIVATE KEY-----\n"

function isValidPemPrivateKey(key: string): boolean {
  return /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+-----END [A-Z ]*PRIVATE KEY-----/.test(key.trim())
}
// Go callers can call the same validator the handler uses:
if err := service.ValidateOpenAIAgentIdentityPrivateKey(key); err != nil {
    // reject before persisting
}

if err := service.ValidateOpenAIAgentIdentityPrivateKey(item.AgentPrivateKey); err != nil {
    return fmt.Errorf("entry %d: agent identity private key 格式无效: %w", entry.Index, err)
}

When it happens

Trigger: Importing an agent identity whose agent_private_key is malformed: not valid PEM, wrong key type, base64-corrupted body, missing header/footer lines, or a key copied with line breaks mangled by clipboard/JSON escaping.

Common situations: Copying the key from a terminal and losing the last line; pasting through a tool that wraps or escapes newlines; exporting from a different OpenAI tool version with another key format; trailing whitespace or BOM characters included in the string.

Related errors

• agent identity 缺少必要字段
• 空 JSON 内容
• 缺少 accessToken/access_token
• 未包含 refresh_token，且无法解析 accessToken 过期时间；请在第一步设置过期时间后再导入
• proxies is required

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/125f6ac4f8420410. Report an issue: GitHub.