{"record":{"id":"c620732a029ee5b0","repo":"iflytek/astron-agent","slug":"workflow-internal-api-authentication-is-not-configured","errorCode":null,"errorMessage":"Workflow internal API authentication is not configured","messagePattern":"Workflow internal API authentication is not configured","errorType":"http","errorClass":"HTTPException","httpStatus":503,"severity":"critical","filePath":"core/agent/infra/workflow_internal_auth.py","lineNumber":37,"sourceCode":"    auto_error=False,\n)\n\n\ndef optional_workflow_internal_api_key() -> str:\n    \"\"\"Return a valid deployment-internal key without accepting published defaults.\"\"\"\n    return credential_from_env_or_file(\n        WORKFLOW_INTERNAL_API_KEY_ENV,\n        WORKFLOW_INTERNAL_API_KEY_FILE_ENV,\n        min_length=WORKFLOW_INTERNAL_API_KEY_MIN_LENGTH,\n        placeholders=(WORKFLOW_INTERNAL_API_KEY_PLACEHOLDER,),\n    )\n\n\ndef configured_workflow_internal_api_key() -> str:\n    \"\"\"Return the configured key or fail closed while deployment is incomplete.\"\"\"\n    api_key = optional_workflow_internal_api_key()\n    if not api_key:\n        raise HTTPException(\n            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,\n            detail=\"Workflow internal API authentication is not configured\",\n        )\n    return api_key\n\n\nasync def require_workflow_internal_api_key(\n    supplied_api_key: Annotated[\n        str | None, Security(_workflow_internal_api_key_header)\n    ],\n) -> None:\n    \"\"\"Require the same internal credential shared by Workflow and Agent.\"\"\"\n    expected_api_key = configured_workflow_internal_api_key()\n    if not supplied_api_key or not secrets.compare_digest(\n        supplied_api_key, expected_api_key\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/agent/infra/workflow_internal_auth.py#L19-L55","documentation":"configured_workflow_internal_api_key() reads the shared internal API key for Agent<->Workflow authentication and deliberately fails closed: if the key is unset it returns HTTP 503 instead of serving unauthenticated traffic. It guards service-to-service endpoints while deployment configuration is incomplete.","triggerScenarios":"Any request hitting a route protected by require_workflow_internal_api_key when the internal-key env/config variable is absent or empty in the Agent service (workflow_internal_auth.py:37).","commonSituations":"Fresh deployment where WORKFLOW_INTERNAL_API_KEY env var was never set; docker-compose/helm values missing the secret; key removed after a config refactor; local dev without the .env file loaded.","solutions":["Set the internal API key env var (e.g. WORKFLOW_INTERNAL_API_KEY) to the same strong random value on both Agent and Workflow services","Add the key to docker-compose/helm secrets so deployments get it automatically","Restart the Agent service after setting the variable and confirm it is visible in the process environment","Ensure key generation/distribution is part of deployment tooling so it can never be empty"],"exampleFix":"// before\ndocker run ... core/agent   # key never provided\n// after\ndocker run -e WORKFLOW_INTERNAL_API_KEY=\"$SHARED_KEY\" ... core/agent","handlingStrategy":"validation","validationCode":"import os\nassert os.getenv(\"WORKFLOW_INTERNAL_API_KEY\"), \"WORKFLOW_INTERNAL_API_KEY must be set before starting the service\"","typeGuard":"def internal_auth_configured() -> bool:\n    return bool(os.getenv(\"WORKFLOW_INTERNAL_API_KEY\"))","tryCatchPattern":"try:\n    call_internal_api(url, key=configured_workflow_internal_api_key())\nexcept HTTPException as e:\n    if e.status_code == 503:\n        logger.error(\"internal auth not configured; aborting deployment\")\n        raise","preventionTips":["Generate and distribute the shared key in deployment tooling, never manually","Add a startup check that fails fast when the key is missing","Document the required env var in deployment templates and READMEs"],"tags":["authentication","config","deployment"],"backgroundTag":"missing-env-var","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}