{"record":{"id":"786bf7be8426702c","repo":"alibaba/nacos","slug":"invalidkey","errorCode":null,"errorMessage":"InvalidKey","messagePattern":"InvalidKey","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java","lineNumber":78,"sourceCode":"        return mac.doFinal(region.getBytes(StandardCharsets.UTF_8));\n    }\n    \n    private static byte[] finalSigningKey(String secret, String date, String region,\n        String productCode,\n        String signMethod) {\n        try {\n            byte[] secondSignkey = regionSigningKey(secret, date, region, signMethod);\n            Mac mac = Mac.getInstance(signMethod);\n            mac.init(new SecretKeySpec(secondSignkey, signMethod));\n            byte[] thirdSigningKey = mac.doFinal(productCode.getBytes(StandardCharsets.UTF_8));\n            // 计算最终派生秘钥\n            mac = Mac.getInstance(signMethod);\n            mac.init(new SecretKeySpec(thirdSigningKey, signMethod));\n            return mac.doFinal(CONSTANT.getBytes(StandardCharsets.UTF_8));\n        } catch (NoSuchAlgorithmException e) {\n            throw new RuntimeException(\"unsupported Algorithm:\" + signMethod);\n        } catch (InvalidKeyException e) {\n            throw new RuntimeException(\"InvalidKey\");\n        }\n    }\n    \n    /**\n     * Return V4 signature key with base64 encode.\n     *\n     * @param secret      secret key\n     * @param date        date  with utc format, like 20211222\n     * @param region      region id\n     * @param productCode cloud product code\n     * @param signMethod  sign method\n     * @return V4 signature key with base64 encode\n     */\n    public static String finalSigningKeyString(String secret, String date, String region,\n        String productCode,\n        String signMethod) {\n        return Base64.getEncoder()\n            .encodeToString(finalSigningKey(secret, date, region, productCode, signMethod));","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java#L60-L96","documentation":"Thrown by CalculateV4SigningKeyUtil.finalSigningKey() as an unchecked RuntimeException when mac.init(new SecretKeySpec(...)) throws InvalidKeyException. This means the provided secret key bytes are invalid for the specified MAC algorithm — e.g. the key is null, empty, zero-length, or does not meet the algorithm's key requirements. The error message 'InvalidKey' does not include details; check the suppressed cause.","triggerScenarios":"The secretKey parameter passed to the signing utility is null, empty, or contains invalid bytes. This flows from the RAM credential configuration: StsConfig or CredentialService provides an empty/null secretKey.","commonSituations":"Access key / secret key configured but secret is blank; STS credentials returned an empty secretKey field; credentials loaded from environment variables that were unset; CredentialService not properly initialized.","solutions":["Verify that PropertyKeyConst.SECRET_KEY or the credential source provides a non-empty secret key.","If using STS, check that the STS response contains a valid SecretAccessKey field.","Ensure CredentialService.getInstance().getCredential().getSecretKey() returns a non-null, non-empty value.","If loading credentials from a file or environment variable, verify the file exists and the variable is set."],"exampleFix":"// before — empty secret key\nprops.setProperty(PropertyKeyConst.ACCESS_KEY, \"AKID...\");\nprops.setProperty(PropertyKeyConst.SECRET_KEY, \"\");\n\n// after\nprops.setProperty(PropertyKeyConst.ACCESS_KEY, \"AKID...\");\nprops.setProperty(PropertyKeyConst.SECRET_KEY, \"your-valid-secret-key\");","handlingStrategy":"validation","validationCode":"String secretKey = CredentialService.getInstance().getCredential().getSecretKey();\nif (secretKey == null || secretKey.isEmpty()) {\n    throw new IllegalStateException(\"Secret key is null or empty — cannot sign requests.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, signMethod);\n} catch (RuntimeException e) {\n    if (e.getMessage().equals(\"InvalidKey\")) {\n        throw new IllegalStateException(\"Invalid signing key — check that the secret key is non-empty and valid\", e);\n    }\n    throw e;\n}","preventionTips":["Validate that ACCESS_KEY and SECRET_KEY are non-empty before client initialization.","If using STS, verify the STS response contains a valid SecretAccessKey.","Log credential presence (not values) at startup to catch configuration gaps early."],"tags":["auth","ram","crypto","credentials","signing"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}