{"record":{"id":"cb75d8c1841f3d1f","repo":"iflytek/astron-agent","slug":"ragflow-api-token-not-configured-in-environment-variables","errorCode":null,"errorMessage":"RAGFLOW_API_TOKEN not configured in environment variables","messagePattern":"RAGFLOW_API_TOKEN not configured in environment variables","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"core/knowledge/infra/ragflow/ragflow_client.py","lineNumber":62,"sourceCode":"_rag_object_config_key = None\n\n\ndef get_rag_object() -> Any:\n    \"\"\"\n    Get or create RAGFlow client instance with proper configuration loading\n    \"\"\"\n    global _rag_object, _rag_object_config_key\n    base_url = _config_value(\"base_url\", \"RAGFLOW_BASE_URL\", \"\")\n    api_key = _config_value(\"api_token\", \"RAGFLOW_API_TOKEN\", \"\")\n    config_key = (base_url, api_key)\n    if _rag_object is None or _rag_object_config_key != config_key:\n        if RAGFlow is None:\n            raise ImportError(\"ragflow_sdk is not available\")\n\n        if not base_url:\n            raise ValueError(\"RAGFLOW_BASE_URL not configured in environment variables\")\n        if not api_key:\n            raise ValueError(\n                \"RAGFLOW_API_TOKEN not configured in environment variables\"\n            )\n\n        _rag_object = RAGFlow(api_key=api_key, base_url=base_url)\n        _rag_object_config_key = config_key\n        print(f\"RAGFlow client initialized with base_url: {base_url}\")\n\n    return _rag_object\n\n\ndef _load_ragflow_config() -> Dict[str, Any]:\n    \"\"\"\n    Load RAGFlow configuration from constants module (with caching)\n\n    Returns:\n        Configuration dictionary\n    \"\"\"\n    global _config_cache","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/knowledge/infra/ragflow/ragflow_client.py#L44-L80","documentation":"get_rag_object also requires an API token: if RAGFLOW_API_TOKEN (or the 'api_token' config value) is empty, it raises ValueError so the RAGFlow SDK is never created without credentials. This is the authentication half of the client-construction guard, parallel to the base-URL check.","triggerScenarios":"First RAGFlow SDK call when RAGFLOW_API_TOKEN is unset or empty in the core/knowledge process environment, even if RAGFLOW_BASE_URL is correctly configured.","commonSituations":"API token generated in the RAGFlow UI but never added to deployment secrets; token key rotated/renamed in helm values; secret mounted but with wrong key name; token left as empty placeholder in .env.","solutions":["Generate an API key in the RAGFlow web UI and set RAGFLOW_API_TOKEN in the service environment","Check the Kubernetes secret/configmap actually contains the token under the expected key","Restart the knowledge service after adding the variable (get_rag_object caches per config key but construction happens on first use)","Verify inside the container: env | grep RAGFLOW_API_TOKEN"],"exampleFix":"# before\nRAGFLOW_API_TOKEN=\n# after\nRAGFLOW_API_TOKEN=ragflow-xxxxxxxxxxxxxxxx","handlingStrategy":"validation","validationCode":"import os\ndef ragflow_credentials_ready() -> bool:\n    return bool(os.environ.get('RAGFLOW_API_TOKEN', '').strip())","typeGuard":null,"tryCatchPattern":"try:\n    rag = get_rag_object()\nexcept ValueError as e:\n    if 'RAGFLOW_API_TOKEN' in str(e):\n        logger.error('RAGFlow API token missing: %s', e)\n        rag = None","preventionTips":["Store RAGFLOW_API_TOKEN in a secret manager and mount it into the service","Generate the token from the same RAGFlow instance as RAGFLOW_BASE_URL","Check credential presence in readiness probes"],"tags":["configuration","api-key","authentication","ragflow"],"backgroundTag":"missing-api-key","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}