{"record":{"id":"c0f7a70258f5abde","repo":"kgretzky/evilginx2","slug":"invalid-api-key","errorCode":null,"errorMessage":"invalid api key","messagePattern":"invalid api key","errorType":"exception","errorClass":null,"httpStatus":401,"severity":"error","filePath":"core/gophish.go","lineNumber":144,"sourceCode":"\n\treq := cl.R().\n\t\tSetHeader(\"Content-Type\", \"application/json\").\n\t\tSetAuthToken(o.ApiKey)\n\n\tif content != nil {\n\t\tresp, err = req.SetBody(content).Post(reqUrl)\n\t} else {\n\t\tresp, err = req.Get(reqUrl)\n\t}\n\n\tif err != nil {\n\t\treturn err\n\t}\n\tswitch resp.StatusCode() {\n\tcase 200:\n\t\treturn nil\n\tcase 401:\n\t\treturn fmt.Errorf(\"invalid api key\")\n\tdefault:\n\t\treturn fmt.Errorf(\"status: %d\", resp.StatusCode())\n\t}\n}\n\nfunc (o *GoPhish) validateSetup() error {\n\tif o.AdminUrl == nil {\n\t\treturn fmt.Errorf(\"admin url is not set\")\n\t}\n\tif o.ApiKey == \"\" {\n\t\treturn fmt.Errorf(\"api key is not set\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":126,"sourceCodeEnd":159,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/gophish.go#L126-L159","documentation":"apiRequest received HTTP 401 from the GoPhish admin API, meaning the configured ApiKey was rejected as an authentication credential. It fires after a successful request round-trip; the request itself is fine, the key is wrong, revoked, or lacks permission.","triggerScenarios":"Calling GoPhish Test, ReportEmailOpened, ReportEmailLinkClicked, or ReportCredentialsSubmitted when o.ApiKey is wrong, revoked, or belongs to a different GoPhish instance than o.AdminUrl.","commonSituations":"Rotating the API key in GoPhish UI without updating evilginx config; copying the key from a staging GoPhish while pointing at production; whitespace/quotes around the pasted key.","solutions":["Regenerate/copy the API key from GoPhish (Users page) and update the integration config","Verify AdminUrl points to the same GoPhish instance that issued the key","Trim whitespace/quotes from the stored key","Run the GoPhish Test method after fixing to confirm 200 responses"],"exampleFix":"// before\no.SetApiKey(\"  old-key  \")\n// after\no.SetApiKey(strings.TrimSpace(newKeyFromGoPhish))","handlingStrategy":"try-catch","validationCode":"// check before calling\nif gophish.ApiKey == \"\" { return errors.New(\"api key not configured\") }","typeGuard":null,"tryCatchPattern":"if err := gp.ReportEmailOpened(campaignID, email); err != nil {\n    if err.Error() == \"invalid api key\" {\n        // prompt for a new API key and retry once\n    }\n}","preventionTips":["Re-copy the key after any GoPhish key rotation","Trim whitespace/quotes from pasted keys","Ensure AdminUrl and key belong to the same instance","Periodically call GoPhish Test as a health check"],"tags":["gophish","auth","api-key","http-401"],"backgroundTag":"invalid-api-key","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}