{"record":{"id":"c7945982abf87415","repo":"JuliusBrussee/caveman","slug":"cache-replay-anthropic-api-key-unavailable","errorCode":null,"errorMessage":"cache-replay: ANTHROPIC_API_KEY unavailable","messagePattern":"cache-replay: ANTHROPIC_API_KEY unavailable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cacheengine/cmd/cache-replay/main.go","lineNumber":381,"sourceCode":"\t\treturn nil, \"\", fmt.Errorf(\"cache-replay: trace exceeds %d bytes\", maxBytes)\n\t}\n\treturn records, hex.EncodeToString(hash.Sum(nil)), nil\n}\n\nfunc validateProviderCredentials(records []cachebench.TraceRecord) error {\n\tproviders := map[string]bool{}\n\tfor _, record := range records {\n\t\tproviders[record.Provider] = true\n\t}\n\tfor provider := range providers {\n\t\tswitch provider {\n\t\tcase \"openai\":\n\t\t\tif os.Getenv(\"OPENAI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: OPENAI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"anthropic\":\n\t\t\tif os.Getenv(\"ANTHROPIC_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: ANTHROPIC_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"gemini\":\n\t\t\tif os.Getenv(\"GEMINI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: GEMINI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"bedrock\":\n\t\t\tif os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\") == \"\" && (os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" || os.Getenv(\"AWS_SECRET_ACCESS_KEY\") == \"\") {\n\t\t\t\treturn errors.New(\"cache-replay: Bedrock bearer token or AWS access credentials unavailable\")\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"cache-replay: unsupported provider %q\", provider)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc verifierEnvironment(extra []string) ([]string, error) {\n\tallowed := map[string]bool{\"PATH\": true, \"LANG\": true, \"LC_ALL\": true, \"TMPDIR\": true}","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/cacheengine/cmd/cache-replay/main.go#L363-L399","documentation":"Returned by validateProviderCredentials when the trace contains anthropic requests but ANTHROPIC_API_KEY is empty in the cache-replay process. Same fail-fast pre-flight as the other provider checks: every distinct provider in the trace must have credentials present before live replay starts.","triggerScenarios":"Trace with provider \"anthropic\" records and no ANTHROPIC_API_KEY exported to the cache-replay process.","commonSituations":"Multi-provider traces where only the OpenAI key was configured; secret named differently in the vault (e.g. ANTHROPIC_KEY); keys set in a docker layer but overridden by an empty env entry in compose.","solutions":["Export ANTHROPIC_API_KEY for the cache-replay process","Verify with: printenv ANTHROPIC_API_KEY (check presence, do not log the value)","Filter the trace to providers with available credentials if Anthropic replay is not intended"],"exampleFix":"# before\ncache-replay -execute ...\n\n# after\nexport ANTHROPIC_API_KEY=\"$ANTHROPIC_KEY\"\ncache-replay -execute ...","handlingStrategy":"validation","validationCode":"if providers[\"anthropic\"] && os.Getenv(\"ANTHROPIC_API_KEY\") == \"\" {\n\treturn errors.New(\"set ANTHROPIC_API_KEY before live replay\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add per-provider credential assertions to a pre-run script rather than discovering them via fatal exit","Use secret-manager bridging (export ANTHROPIC_API_KEY from your vault ref) so names always match"],"tags":["go","credentials","environment","cli"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}