affaan-m/ECC · critical · AuthenticationError

msg

Error message

msg

What it means

In AstraFlowProvider.generate()'s except block (src/llm/providers/astraflow.py:118), any exception whose string form contains '401' or 'authentication' (case-insensitive) is re-raised as AuthenticationError(msg, provider=...) with the original as __cause__. The reported message 'msg' in catalogs is the captured str(e) of the underlying SDK exception — commonly an openai.AuthenticationError with 'Error code: 401'.

Solutions

  1. Verify the API key is the correct, active key for this provider and set it in the environment the process actually sees.
  2. Print/dump the resolved config (never the key itself) and confirm the key variable name matches what the provider reads.
  3. Test the key directly with a minimal curl/SDK call to the provider endpoint to isolate harness vs. credential issues.
  4. Rotate the key if it may have leaked or been revoked.

Example fix

# before
provider = AstraFlowProvider(api_key=os.environ.get("ASTRAFLOW_API_KEY", ""))
out = provider.generate(inp)  # AuthenticationError: Error code: 401 ...

# after: fail fast on missing credentials
api_key = os.environ["ASTRAFLOW_API_KEY"]  # KeyError at startup, not 401 at request time
provider = AstraFlowProvider(api_key=api_key)
assert provider.validate_config()
Defensive patterns

Strategy: try-catch

Validate before calling

import os

def astraflow_config_ok() -> bool:
    key = os.environ.get("ASTRAFLOW_API_KEY", "")
    return bool(key) and not key.startswith("sk-placeholder")  # presence check only; real check is a live call

Try / catch

from src.llm.core.interface import AuthenticationError

try:
    out = provider.generate(inp)
except AuthenticationError:
    # credentials are wrong/revoked — never retry, alert instead
    alerts.critical("AstraFlow auth failed; rotate ASTRAFLOW_API_KEY")
    raise

Prevention

When it happens

Trigger: Invalid, missing, or revoked API key; key for the wrong project/environment; Authorization header stripped by a proxy; expired token; key typo'd in the provider config (validate_config() only checks truthiness, so a wrong-but-present key passes config validation and fails here at request time).

Common situations: API key read from an env var that is unset in the deployed environment (falls back to an empty/placeholder value); rotating keys and forgetting one consumer; using a key from a different region/gateway; local .env not loaded.

Related errors

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/5339234a7f327b79. Report an issue: GitHub.

Appendix: source

Thrown at src/llm/providers/astraflow.py:116

            usage = None
            if response.usage:
                usage = {
                    "prompt_tokens": response.usage.prompt_tokens,
                    "completion_tokens": response.usage.completion_tokens,
                    "total_tokens": response.usage.total_tokens,
                }

            return LLMOutput(
                content=choice.message.content or "",
                tool_calls=tool_calls,
                model=response.model,
                usage=usage,
                stop_reason=choice.finish_reason,
            )
        except Exception as e:
            msg = str(e)
            if "401" in msg or "authentication" in msg.lower():
                raise AuthenticationError(msg, provider=self.provider_type) from e
            if "429" in msg or "rate_limit" in msg.lower():
                raise RateLimitError(msg, provider=self.provider_type) from e
            if "context" in msg.lower() and "length" in msg.lower():
                raise ContextLengthError(msg, provider=self.provider_type) from e
            raise

    def list_models(self) -> list[ModelInfo]:
        return self._models.copy()

    def validate_config(self) -> bool:
        return bool(self.api_key)

    def get_default_model(self) -> str:
        return self.default_model


class AstraflowProvider(_AstraflowBaseProvider):
    """UModelVerse global endpoint using OpenAI-compatible chat completions."""

View on GitHub (pinned to d8409a4b08)