{"record":{"id":"62ac1c17f0b5a293","repo":"langgenius/dify","slug":"api-key-is-invalid","errorCode":null,"errorMessage":"API key is invalid.","messagePattern":"API key is invalid\\.","errorType":"http","errorClass":"Unauthorized","httpStatus":401,"severity":"error","filePath":"api/controllers/console/admin.py","lineNumber":15,"sourceCode":"from collections.abc import Callable\nfrom functools import wraps\n\nfrom flask import request\nfrom werkzeug.exceptions import Unauthorized\n\nfrom configs import dify_config\nfrom libs.token import extract_access_token\n\n\ndef admin_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:\n    @wraps(view)\n    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:\n        if not dify_config.ADMIN_API_KEY:\n            raise Unauthorized(\"API key is invalid.\")\n\n        auth_token = extract_access_token(request)\n        if not auth_token:\n            raise Unauthorized(\"Authorization header is missing.\")\n        if auth_token != dify_config.ADMIN_API_KEY:\n            raise Unauthorized(\"API key is invalid.\")\n\n        return view(*args, **kwargs)\n\n    return decorated\n","sourceCodeStart":1,"sourceCodeEnd":26,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/admin.py#L1-L26","documentation":" werkzeug Unauthorized (HTTP 401) from the admin_required guard: dify_config.ADMIN_API_KEY is falsy (unset/empty), so the entire admin API surface is disabled. No admin request can be authorized until the operator configures the key. The same message is reused at line 21 for a wrong-key mismatch, but this path is specifically the 'admin API not configured' branch.","triggerScenarios":"Calling any endpoint behind @admin_required (console admin routes) when the ADMIN_API_KEY environment/config value is not set. The first such request always fails until an operator sets the key.","commonSituations":"Fresh deployment without ADMIN_API_KEY populated in docker/.env or the API process env; config reload that reset the key to empty; secret manager outage that failed to inject ADMIN_API_KEY; CI environment that exercises an admin route without provisioning the key.","solutions":["Set ADMIN_API_KEY to a strong secret in the API process environment (docker/.env for compose, helm values for k8s) and restart the API service.","Confirm the value is loaded: dify_config.ADMIN_API_KEY should be non-empty after startup.","If you intentionally disabled admin access, remove or stop calling the admin endpoint rather than leaving it half-configured.","Rotate and re-inject the key from your secret manager if it was wiped by a config sync."],"exampleFix":"# before (docker/.env)\n# ADMIN_API_KEY=\n# after\nADMIN_API_KEY=<strong-random-secret>","handlingStrategy":"validation","validationCode":"from configs import dify_config\n\ndef admin_api_enabled() -> bool:\n    return bool(getattr(dify_config, 'ADMIN_API_KEY', '') and dify_config.ADMIN_API_KEY.strip())","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision ADMIN_API_KEY in every environment that runs admin routes (compose env, helm values, CI).","Fail deployment startup if ADMIN_API_KEY is empty when admin routes are enabled.","Keep the key in a secret manager and verify injection on deploy."],"tags":["auth","admin","config","unauthorized","env"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}