{"record":{"id":"a5c460fec6a33aa1","repo":"weaviate/weaviate","slug":"invalid-token-a5c460","errorCode":null,"errorMessage":"invalid token","messagePattern":"invalid token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authentication/apikey/keys/key_generation.go","lineNumber":99,"sourceCode":"\tb := make([]byte, length)\n\t_, err := rand.Read(b)\n\t// Note that err == nil only if we read len(b) bytes.\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn b, nil\n}\n\nfunc DecodeApiKey(fullApiKey string) (string, string, error) {\n\tdecodeString, err := base64.StdEncoding.DecodeString(fullApiKey)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\tparts := strings.Split(string(decodeString), \"_\")\n\tif len(parts) != 3 {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid token\")\n\t}\n\n\tuserIdentifier := parts[0]\n\trandomKey := parts[1]\n\tversion := parts[2]\n\tif version != DynUserIdentifier {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid token\")\n\t}\n\n\tif len(userIdentifier) != UserIdentifierBytesBase64Length {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid token\")\n\t}\n\n\tif len(randomKey) != RandomBytesBase64Length {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid token\")\n\t}\n\n\treturn randomKey, userIdentifier, nil","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authentication/apikey/keys/key_generation.go#L81-L117","documentation":"DecodeApiKey base64-decoded the presented API key successfully but the decoded payload did not split into exactly three underscore-separated parts (user, random key, version marker). This is a format guard: the token is structurally not a Weaviate-issued dynamic-user key — usually a static API key or arbitrary string presented to the dynamic-user auth path.","triggerScenarios":"Thrown at usecases/auth/authentication/apikey/keys/key_generation.go:99 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the client is sending a dynamically generated API key, not a static one","Check the key was copied fully without truncation or extra whitespace","Regenerate the key via the users API if its format is suspect","Route static keys to the static API-key auth scheme instead"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}