{"record":{"id":"28a6e44f3b1ed664","repo":"langchain-ai/deepagents","slug":"runloop-rejected-the-credentials-check-runloop-ap","errorCode":null,"errorMessage":"Runloop rejected the credentials; check RUNLOOP_API_KEY (or DEEPAGENTS_CODE_RUNLOOP_API_KEY): {e}","messagePattern":"Runloop rejected the credentials; check RUNLOOP_API_KEY \\(or DEEPAGENTS_CODE_RUNLOOP_API_KEY\\): (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"libs/partners/runloop/langchain_runloop/provider.py","lineNumber":213,"sourceCode":"        env_blueprint_name = self._resolve_env(\"RUNLOOP_SANDBOX_BLUEPRINT_NAME\")\n        blueprint_name = snapshot or env_blueprint_name\n        use_blueprint = env_blueprint_id is not None or blueprint_name is not None\n\n        try:\n            if use_blueprint:\n                devbox = self._create_from_blueprint(\n                    blueprint_id=env_blueprint_id,\n                    blueprint_name=blueprint_name,\n                    dockerfile=dockerfile,\n                )\n            else:\n                devbox = self._sdk.devbox.create()\n        except (AuthenticationError, PermissionDeniedError) as e:\n            msg = (\n                \"Runloop rejected the credentials; check RUNLOOP_API_KEY \"\n                f\"(or DEEPAGENTS_CODE_RUNLOOP_API_KEY): {e}\"\n            )\n            raise RuntimeError(msg) from e\n        except (APIConnectionError, APITimeoutError) as e:\n            msg = f\"Runloop API unreachable (transient — safe to retry): {e}\"\n            raise RuntimeError(msg) from e\n        except Exception as e:\n            target = blueprint_name or env_blueprint_id or \"devbox\"\n            msg = f\"Failed to create Runloop devbox from '{target}': {e}\"\n            raise RuntimeError(msg) from e\n\n        return RunloopSandbox(devbox=devbox)\n\n    def _create_from_blueprint(\n        self,\n        *,\n        blueprint_id: str | None,\n        blueprint_name: str | None,\n        dockerfile: str,\n    ) -> Devbox:\n        if blueprint_id is not None:","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/partners/runloop/langchain_runloop/provider.py#L195-L231","documentation":"Raised when Runloop's API returns `AuthenticationError` or `PermissionDeniedError` during devbox/blueprint creation, translated into a `RuntimeError` that names the credential env vars to check (`RUNLOOP_API_KEY` or its `DEEPAGENTS_CODE_` prefixed override). It means the bearer token is missing, invalid, revoked, or lacks permission for the requested operation.","triggerScenarios":"`get_or_create` (create path, with or without a blueprint) where the configured API key is wrong, expired, unset-but-nonempty garbage, or the key's account is not allowed to create devboxes/blueprints.","commonSituations":"Copy-pasted key with whitespace or truncation; key rotated or revoked; using a production key against a different org/project; the `DEEPAGENTS_CODE_RUNLOOP_API_KEY` override shadowing a valid `RUNLOOP_API_KEY` (or vice versa); CI secrets not injected.","solutions":["Print/verify the key source: check whether `DEEPAGENTS_CODE_RUNLOOP_API_KEY` is set and overriding `RUNLOOP_API_KEY` (note: empty values are treated as unset).","Generate a fresh API key in the Runloop dashboard and export it: `export RUNLOOP_API_KEY=rl_...`.","Strip whitespace/quotes from the key value in your shell profile or CI secrets.","Confirm the key belongs to the org/project you are targeting and has devbox-create permissions.","Retry after fixing; if it persists, test the key with a direct SDK/HTTP call to isolate the provider."],"exampleFix":"// before\nexport RUNLOOP_API_KEY=\"stale-revoked-key\"\n\n// after\nunset DEEPAGENTS_CODE_RUNLOOP_API_KEY\nexport RUNLOOP_API_KEY=\"rl_live_valid_key\"\nprovider = RunloopProvider(api_key=os.environ[\"RUNLOOP_API_KEY\"])","handlingStrategy":"validation","validationCode":"import os, re\n\ndef has_api_key() -> bool:\n    key = os.environ.get(\"DEEPAGENTS_CODE_RUNLOOP_API_KEY\") or os.environ.get(\"RUNLOOP_API_KEY\")\n    return bool(key and key.strip())","typeGuard":"def is_plausible_runloop_key(key: str | None) -> bool:\n    return bool(key) and key == key.strip() and len(key) >= 20","tryCatchPattern":"try:\n    sandbox = provider.get_or_create()\nexcept RuntimeError as e:\n    if \"credentials\" in str(e):\n        raise SystemExit(\"Fix RUNLOOP_API_KEY (or DEEPAGENTS_CODE_RUNLOOP_API_KEY) and retry\") from e\n    raise","preventionTips":["Check startup that exactly one of RUNLOOP_API_KEY / DEEPAGENTS_CODE_RUNLOOP_API_KEY is set to a valid value.","Never commit keys; load from a secrets manager in CI and verify injection succeeded.","Strip whitespace and quotes when reading keys from env files.","Rotate keys on a schedule and update all environments; test the key with a cheap API call at boot."],"tags":["authentication","api-key","runloop","credentials"],"backgroundTag":"invalid-api-key","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}