{"record":{"id":"424949e4ab9540fd","repo":"infiniflow/ragflow","slug":"tenki-authentication-failed-check-the-api-key","errorCode":null,"errorMessage":"Tenki authentication failed: check the API key.","messagePattern":"Tenki authentication failed: check the API key\\.","errorType":"exception","errorClass":"SandboxProviderConfigError","httpStatus":null,"severity":"critical","filePath":"agent/sandbox/providers/tenki.py","lineNumber":151,"sourceCode":"            \"metadata\": {\"source\": \"ragflow\"},\n        }\n        if self.image:\n            create_kwargs[\"image\"] = self.image\n        if self.cpu_cores > 0:\n            create_kwargs[\"cpu_cores\"] = self.cpu_cores\n        if self.memory_mb > 0:\n            create_kwargs[\"memory_mb\"] = self.memory_mb\n        if self.disk_size_gb > 0:\n            create_kwargs[\"disk_size_gb\"] = self.disk_size_gb\n\n        try:\n            sandbox = self._client.create(**create_kwargs)\n        except errors.QuotaExceededError as exc:\n            raise RuntimeError(f\"Tenki quota exceeded: {exc}\") from exc\n        except errors.RateLimitedError as exc:\n            raise RuntimeError(f\"Tenki rate limited, please retry: {exc}\") from exc\n        except errors.UnauthorizedError as exc:\n            raise SandboxProviderConfigError(\"Tenki authentication failed: check the API key.\") from exc\n        except Exception as exc:\n            # Satisfy the base contract: any other SDK failure becomes RuntimeError.\n            raise RuntimeError(f\"Failed to create Tenki sandbox: {exc}\") from exc\n\n        remote_work_dir = posixpath.join(SANDBOX_HOME, f\"ragflow-codeexec-{uuid.uuid4().hex}\")\n        try:\n            result = sandbox.exec(\n                \"mkdir\",\n                \"-p\",\n                posixpath.join(remote_work_dir, \"artifacts\"),\n                timeout=min(self.timeout, 10),\n            )\n            if result.exit_code != 0:\n                raise RuntimeError(f\"Failed to create sandbox workspace: {result.stderr_text or 'unknown error'}\")\n        except Exception:\n            self._safe_terminate(sandbox)\n            raise\n","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/agent/sandbox/providers/tenki.py#L133-L169","documentation":"Raised when client.create() during create_instance() throws errors.UnauthorizedError: the Tenki API rejected the configured api_key. It is mapped to SandboxProviderConfigError (not RuntimeError) because it is a configuration problem, not a transient runtime failure.","triggerScenarios":"initialize() with an api_key that is expired, revoked, or copied incorrectly (whitespace handled, but wrong key is not); creation then fails the first authenticated call. Note initialize()'s who_am_i() connectivity check usually catches this earlier — seeing it here means the key became invalid between initialize() and create_instance().","commonSituations":"Rotated or expired API keys, keys from a different Tenki environment than base_url points at, or a key that lost sandbox permissions.","solutions":["Verify the api_key against the Tenki console and update the sandbox provider config.","Confirm the key matches the environment of base_url (no staging key against production endpoint, and vice versa).","If the key was recently rotated, re-run initialize() with the new key — the cached client holds the old auth_token."],"exampleFix":"# before\nprovider.initialize({\"api_key\": \"tk_old_revoked_key\"})\n\n# after\nprovider.initialize({\"api_key\": os.environ[\"TENKI_API_KEY\"]})  # current key from secrets store","handlingStrategy":"try-catch","validationCode":"from agent.sandbox.providers.base import SandboxProviderConfigError\n# fail fast at startup instead of at create time:\nprovider.initialize({\"api_key\": key})  # who_am_i() check raises here if key is bad","typeGuard":null,"tryCatchPattern":"try:\n    instance = provider.create_instance(template)\nexcept SandboxProviderConfigError as exc:\n    if \"authentication failed\" in str(exc):\n        alert_key_rotation()  # key is dead; do not retry, reconfigure\n    raise","preventionTips":["Automate key rotation: update the provider config and re-initialize when keys change.","Match api_key environment to base_url environment.","Alert on SandboxProviderConfigError at create time — it means credentials expired mid-session."],"tags":["authentication","config","api-key","tenki"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}