{"record":{"id":"04f2ba83a4a7f57f","repo":"decolua/9router","slug":"api-key-validation-failed-error-message","errorCode":null,"errorMessage":"API key validation failed: ${error.message}","messagePattern":"API key validation failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/kiro.js","lineNumber":340,"sourceCode":"      throw new Error(\"API key returned no available models\");\n    }\n    return models;\n  }\n\n  /**\n   * Validate an API-key credential through the same Amazon Q surface used for\n   * inference. API keys are account-bound but do not require a profileArn.\n   */\n  async validateApiKey(apiKey, region = \"us-east-1\") {\n    if (!apiKey || typeof apiKey !== \"string\" || !apiKey.trim()) {\n      throw new Error(\"API key is required\");\n    }\n    const trimmed = apiKey.trim();\n\n    try {\n      await this.listAvailableApiKeyModels(trimmed, region);\n    } catch (error) {\n      throw new Error(`API key validation failed: ${error.message}`);\n    }\n\n    return {\n      accessToken: trimmed,\n      refreshToken: null,\n      profileArn: null,\n      region,\n      authMethod: \"api_key\",\n    };\n  }\n\n  /**\n   * List available models from CodeWhisperer API\n   */\n  async listAvailableModels(accessToken, profileArn) {\n    const endpoint = \"https://codewhisperer.us-east-1.amazonaws.com\";\n    const target = \"AmazonCodeWhispererService.ListAvailableModels\";\n","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/services/kiro.js#L322-L358","documentation":"validateApiKey delegates the actual check to listAvailableApiKeyModels and wraps any failure with 'API key validation failed: <root message>'. This wrapper preserves the root cause in error.message while giving callers a single, predictable error for the whole API-key validation flow. The original failure can be a network error, a non-OK HTTP response ('Failed to list API-key models: ...'), or the empty-models verdict.","triggerScenarios":"Calling validateApiKey(apiKey, region) where listAvailableApiKeyModels throws for any reason: fetch rejects (DNS/network), Amazon Q returns non-200 (invalid key -> 401/403, bad region -> 400), or the 200 response has an empty models array.","commonSituations":"Expired or revoked Kiro API key (403 in the wrapped message); typo in region causing an invalid endpoint; offline environment or proxy blocking q.<region>.amazonaws.com; account without model access (empty models message wrapped here).","solutions":["Parse the wrapped root cause from error.message after 'API key validation failed: ' and act on it (401/403 -> new key, network -> connectivity, empty models -> account/region access).","Regenerate the Kiro API key if the message contains an auth/forbidden response body.","Verify the region argument is a valid AWS region reachable from your network.","Add your own try/catch if you need the original error object, since the wrapper discards it."],"exampleFix":"// before\nawait kiro.validateApiKey(key); // throws 'API key validation failed: ...'\n// after\ntry {\n  await kiro.validateApiKey(key);\n} catch (e) {\n  const root = e.message.replace(\"API key validation failed: \", \"\");\n  if (/40[13]/.test(root)) console.error(\"Key rejected — regenerate it\");\n  throw e;\n}","handlingStrategy":"try-catch","validationCode":"const key = (cred?.apiKey ?? \"\").trim();\nif (!key) throw new Error(\"Provide a Kiro API key before validation\");","typeGuard":"function isNonEmptyString(v) {\n  return typeof v === \"string\" && v.trim().length > 0;\n}","tryCatchPattern":"try {\n  await kiro.validateApiKey(key, \"us-east-1\");\n} catch (e) {\n  const root = e.message.startsWith(\"API key validation failed: \")\n    ? e.message.slice(\"API key validation failed: \".length)\n    : e.message;\n  if (/no available models/.test(root)) { /* account/region access issue */ }\n  else if (/Failed to list API-key models/.test(root)) { /* HTTP-level: auth or network */ }\n  throw e;\n}","preventionTips":["Always unwrap the root cause from the 'API key validation failed: ' prefix before diagnosing.","Pre-check the key with a non-empty-string guard to skip avoidable network failures.","Pin a known-good region and make it configurable.","Handle auth (401/403) root causes by prompting for a new key rather than retrying."],"tags":["oauth","api-key","kiro","wrapped-error","validation"],"backgroundTag":"api-key-validation-failed","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}