alibaba/nacos · critical · RuntimeException

InvalidKey

Error message

InvalidKey

What it means

Thrown by CalculateV4SigningKeyUtil.finalSigningKey() as an unchecked RuntimeException when mac.init(new SecretKeySpec(...)) throws InvalidKeyException. This means the provided secret key bytes are invalid for the specified MAC algorithm — e.g. the key is null, empty, zero-length, or does not meet the algorithm's key requirements. The error message 'InvalidKey' does not include details; check the suppressed cause.

Source

Thrown at client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java:78

        return mac.doFinal(region.getBytes(StandardCharsets.UTF_8));
    }
    
    private static byte[] finalSigningKey(String secret, String date, String region,
        String productCode,
        String signMethod) {
        try {
            byte[] secondSignkey = regionSigningKey(secret, date, region, signMethod);
            Mac mac = Mac.getInstance(signMethod);
            mac.init(new SecretKeySpec(secondSignkey, signMethod));
            byte[] thirdSigningKey = mac.doFinal(productCode.getBytes(StandardCharsets.UTF_8));
            // 计算最终派生秘钥
            mac = Mac.getInstance(signMethod);
            mac.init(new SecretKeySpec(thirdSigningKey, signMethod));
            return mac.doFinal(CONSTANT.getBytes(StandardCharsets.UTF_8));
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("unsupported Algorithm:" + signMethod);
        } catch (InvalidKeyException e) {
            throw new RuntimeException("InvalidKey");
        }
    }
    
    /**
     * Return V4 signature key with base64 encode.
     *
     * @param secret      secret key
     * @param date        date  with utc format, like 20211222
     * @param region      region id
     * @param productCode cloud product code
     * @param signMethod  sign method
     * @return V4 signature key with base64 encode
     */
    public static String finalSigningKeyString(String secret, String date, String region,
        String productCode,
        String signMethod) {
        return Base64.getEncoder()
            .encodeToString(finalSigningKey(secret, date, region, productCode, signMethod));

View on GitHub (pinned to 9b989acdf1)

Solutions

  1. Verify that PropertyKeyConst.SECRET_KEY or the credential source provides a non-empty secret key.
  2. If using STS, check that the STS response contains a valid SecretAccessKey field.
  3. Ensure CredentialService.getInstance().getCredential().getSecretKey() returns a non-null, non-empty value.
  4. If loading credentials from a file or environment variable, verify the file exists and the variable is set.

Example fix

// before — empty secret key
props.setProperty(PropertyKeyConst.ACCESS_KEY, "AKID...");
props.setProperty(PropertyKeyConst.SECRET_KEY, "");

// after
props.setProperty(PropertyKeyConst.ACCESS_KEY, "AKID...");
props.setProperty(PropertyKeyConst.SECRET_KEY, "your-valid-secret-key");
Defensive patterns

Strategy: validation

Validate before calling

String secretKey = CredentialService.getInstance().getCredential().getSecretKey();
if (secretKey == null || secretKey.isEmpty()) {
    throw new IllegalStateException("Secret key is null or empty — cannot sign requests.");
}

Try / catch

try {
    key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, signMethod);
} catch (RuntimeException e) {
    if (e.getMessage().equals("InvalidKey")) {
        throw new IllegalStateException("Invalid signing key — check that the secret key is non-empty and valid", e);
    }
    throw e;
}

Prevention

When it happens

Trigger: The secretKey parameter passed to the signing utility is null, empty, or contains invalid bytes. This flows from the RAM credential configuration: StsConfig or CredentialService provides an empty/null secretKey.

Common situations: Access key / secret key configured but secret is blank; STS credentials returned an empty secretKey field; credentials loaded from environment variables that were unset; CredentialService not properly initialized.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/786bf7be8426702c. Report an issue: GitHub.