{"record":{"id":"167739e89fb108e8","repo":"ruvnet/ruflo","slug":"invalid-api-key-length","errorCode":"INVALID_API_KEY_LENGTH","errorMessage":"API key length must be at least 32 characters","messagePattern":"API key length must be at least 32 characters","errorType":"exception","errorClass":"CredentialGeneratorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/credential-generator.ts","lineNumber":132,"sourceCode":"      apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,\n    };\n\n    this.validateConfig();\n  }\n\n  /**\n   * Validates configuration parameters.\n   */\n  private validateConfig(): void {\n    if (this.config.passwordLength < 16) {\n      throw new CredentialGeneratorError(\n        'Password length must be at least 16 characters',\n        'INVALID_PASSWORD_LENGTH'\n      );\n    }\n\n    if (this.config.apiKeyLength < 32) {\n      throw new CredentialGeneratorError(\n        'API key length must be at least 32 characters',\n        'INVALID_API_KEY_LENGTH'\n      );\n    }\n\n    if (this.config.secretLength < 32) {\n      throw new CredentialGeneratorError(\n        'Secret length must be at least 32 characters',\n        'INVALID_SECRET_LENGTH'\n      );\n    }\n  }\n\n  /**\n   * Generates a cryptographically secure random string using rejection sampling\n   * to eliminate modulo bias.\n   *\n   * @param length - Length of the string to generate","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/credential-generator.ts#L114-L150","documentation":"Same constructor-time validation as the password floor, but for key length: apiKeyLength < 32 throws CredentialGeneratorError INVALID_API_KEY_LENGTH. API keys face higher guessing/offline-attack exposure than human passwords, hence the larger floor.","triggerScenarios":"new CredentialGenerator({ apiKeyLength: 20 }); copying a length from password settings into the apiKey field; truncating key length to fit a legacy VARCHAR column.","commonSituations":"Configs written against older docs with lower floors; DB schema constraints driving the key length down; env var for key length shared with a shorter-password setting.","solutions":["Set apiKeyLength >= 32 (48+ typical for URL-safe keys)","Widen the storage column instead of shrinking the key — fix the constraint, not the entropy","Validate the numeric before construction so the error surfaces at config-load time with context"],"exampleFix":"// before\nnew CredentialGenerator({ apiKeyLength: 20 });\n\n// after\nnew CredentialGenerator({ apiKeyLength: 48 });","handlingStrategy":"validation","validationCode":"const MIN_API_KEY = 32;\nif (cfg.apiKeyLength !== undefined && cfg.apiKeyLength < MIN_API_KEY) {\n  throw new Error(`apiKeyLength must be >= ${MIN_API_KEY}, got ${cfg.apiKeyLength}`);\n}\nnew CredentialGenerator(cfg);","typeGuard":"function isCredentialGeneratorError(e: unknown, code?: string): boolean {\n  return e instanceof Error && e.name === 'CredentialGeneratorError'\n    && (code === undefined || (e as { code?: string }).code === code);\n}","tryCatchPattern":"try {\n  return new CredentialGenerator(cfg);\n} catch (e) {\n  if (isCredentialGeneratorError(e, 'INVALID_API_KEY_LENGTH')) {\n    return new CredentialGenerator({ ...cfg, apiKeyLength: 32 });\n  }\n  throw e;\n}","preventionTips":["Keep apiKeyLength separate from passwordLength in shared config objects","Fix storage column widths instead of shrinking key entropy","Range-check all credential-length env vars before construction"],"tags":["security","api-key","configuration","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}