{"record":{"id":"1bfff7171fee7418","repo":"langgenius/dify","slug":"secret-key-is-not-set-and-could-not-be-generated-a","errorCode":null,"errorMessage":"SECRET_KEY is not set and could not be generated at {GENERATED_SECRET_KEY_FILENAME}. Set SECRET_KEY explicitly or make storage writable.","messagePattern":"SECRET_KEY is not set and could not be generated at (.+?)\\. Set SECRET_KEY explicitly or make storage writable\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"api/configs/secret_key.py","lineNumber":33,"sourceCode":"        return secret_key\n\n    return _load_or_create_secret_key()\n\n\ndef _load_or_create_secret_key() -> str:\n    try:\n        persisted_key = storage.load_once(GENERATED_SECRET_KEY_FILENAME).decode(\"utf-8\").strip()\n        if persisted_key:\n            return persisted_key\n    except FileNotFoundError:\n        pass\n\n    generated_key = secrets.token_urlsafe(48)\n\n    try:\n        storage.save(GENERATED_SECRET_KEY_FILENAME, f\"{generated_key}\\n\".encode())\n    except Exception as exc:\n        raise ValueError(\n            f\"SECRET_KEY is not set and could not be generated at {GENERATED_SECRET_KEY_FILENAME}. \"\n            \"Set SECRET_KEY explicitly or make storage writable.\"\n        ) from exc\n\n    return generated_key\n","sourceCodeStart":15,"sourceCodeEnd":39,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/configs/secret_key.py#L15-L39","documentation":"Raised by _load_or_create_secret_key when SECRET_KEY is unset and storage.save('.dify_secret_key') fails. The app tries to persist a freshly generated key so sessions stay stable across restarts; if the storage backend is read-only or misconfigured, generation is refused to avoid rotating the key on every boot (which would invalidate sessions).","triggerScenarios":"SECRET_KEY empty and the configured storage (local fs / S3-compatible) cannot write .dify_secret_key — e.g. read-only mount, missing credentials, or wrong bucket.","commonSituations":"Container filesystem mounted read-only, STORAGE_TYPE set to s3 but STORAGE_S3_* credentials wrong, or volume permission denied.","solutions":["Set SECRET_KEY explicitly in the environment (recommended for production).","If using generated keys, make the storage path writable (mount a writable volume).","For S3-type storage, verify STORAGE_S3_BUCKET/credentials/region so save() succeeds.","Run the container with a writable volume for the storage root."],"exampleFix":"// before\nSECRET_KEY=\n// (read-only fs)\n// after\nSECRET_KEY=<a stable random string of >=32 chars>\n// OR ensure /app/storage is a writable volume","handlingStrategy":"validation","validationCode":"import os\n\ndef secret_key_ok(secret_key: str, storage_writable: bool) -> bool:\n    return bool(secret_key) or storage_writable","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set SECRET_KEY explicitly in production.","Ensure the storage root is writable when relying on auto-generation.","Verify STORAGE_TYPE and its credentials before boot."],"tags":["config","secret-key","storage","security","startup"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}