{"record":{"id":"8b3c92338be295eb","repo":"zeroclaw-labs/zeroclaw","slug":"auth-secret-must-be-64-characters-or-fewer","errorCode":null,"errorMessage":"auth_secret must be 64 characters or fewer","messagePattern":"auth_secret must be 64 characters or fewer","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/http_request.rs","lineNumber":268,"sourceCode":"                    anyhow::bail!(\"Header '{key}' value must be a string, got: {}\", value);\n                };\n                let header_name = HeaderName::from_str(key)\n                    .map_err(|e| anyhow::Error::msg(format!(\"Invalid header name '{key}': {e}\")))?;\n                let header_value = HeaderValue::from_str(str_val).map_err(|e| {\n                    anyhow::Error::msg(format!(\"Invalid value for header '{key}': {e}\"))\n                })?;\n                result.insert(header_name, header_value);\n            }\n        }\n        Ok(result)\n    }\n\n    fn validate_secret_name(secret_name: &str) -> anyhow::Result<()> {\n        if secret_name.is_empty() {\n            anyhow::bail!(\"auth_secret cannot be empty\");\n        }\n        if secret_name.len() > 64 {\n            anyhow::bail!(\"auth_secret must be 64 characters or fewer\");\n        }\n        if !secret_name\n            .chars()\n            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')\n        {\n            anyhow::bail!(\n                \"auth_secret must contain only ASCII letters, numbers, underscores, or hyphens\"\n            );\n        }\n        Ok(())\n    }\n\n    fn resolve_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {\n        Self::validate_secret_name(secret_name)?;\n        self.reload_auth_secret(secret_name)\n    }\n\n    fn reload_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/http_request.rs#L250-L286","documentation":"Thrown by HttpRequestTool::validate_secret_name (crates/zeroclaw-tools/src/http_request.rs:268) when the auth_secret name exceeds 64 bytes. Secret names are used as config.toml table keys and log identifiers, so they are capped at a fixed small length; the limit is measured with .len() (bytes), so multi-byte characters count extra.","triggerScenarios":"auth_secret set to a fully-qualified descriptive name like \"production stripe webhook signing token v2 2026\" (> 64 bytes); passing a path or a whole token string as the name; auto-generated names from service URLs or ARNs that exceed the cap; names with many non-ASCII characters where byte length outruns character count.","commonSituations":"Machine-generated secret identifiers (ARNs, URNs, host-based names); copy-pasting the secret value instead of its name; naming conventions that encode environment + service + purpose into one long key.","solutions":["Shorten the secret key to 64 bytes or fewer, e.g. \"stripe_prod_webhook\", and rename the matching [http_request.secrets] entry.","If names are generated, hash or truncate deterministically and keep a mapping.","Make sure you are passing the secret's name, not its value, in auth_secret."],"exampleFix":"# before\n[http_request.secrets]\n\"production_stripe_webhook_signing_token_v2_2026\" = \"...\"\n\n# after\n[http_request.secrets]\nstripe_prod_webhook = \"...\"\n// caller: {\"auth_secret\": \"stripe_prod_webhook\"}","handlingStrategy":"validation","validationCode":"fn secret_name_length_ok(name: &str) -> bool {\n    !name.is_empty() && name.len() <= 64\n}","typeGuard":null,"tryCatchPattern":"let result = tool.execute(args).await?;\nif let Some(err) = &result.error {\n    if err.contains(\"64 characters or fewer\") {\n        // rename the secret key in config.toml and the caller to something short\n    }\n}","preventionTips":["Adopt short convention names like <service>_<env>_token for secrets.","Validate generated names (bytes <= 64) before writing them into config.toml.","Remember the limit counts bytes, not characters."],"tags":["http","auth","secrets","validation","zeroclaw"],"backgroundTag":"invalid-secret-name","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}