{"record":{"id":"cb7d26ebaca5e672","repo":"Budibase/budibase","slug":"invalid-api-key","errorCode":"invalid_api_key","errorMessage":"Invalid API key","messagePattern":"Invalid API key","errorType":"exception","errorClass":"InvalidAPIKeyWarning","httpStatus":403,"severity":"error","filePath":"packages/backend-core/src/middleware/authenticated.ts","lineNumber":95,"sourceCode":"        {\n          key: apiKey,\n        },\n        db\n      )) as string\n    } catch (err) {\n      userId = undefined\n    }\n    if (userId) {\n      return {\n        valid: true,\n        user: await getUser({\n          userId,\n          tenantId,\n          populateUser,\n        }),\n      }\n    } else {\n      throw new InvalidAPIKeyWarning()\n    }\n  })\n}\n\nfunction getHeader(ctx: Ctx, header: Header): string | undefined {\n  const contents = ctx.request.headers[header]\n  if (Array.isArray(contents)) {\n    throw new Error(\"Unexpected header format\")\n  }\n  return contents\n}\n\n/**\n * This middleware is tenancy aware, so that it does not depend on other middlewares being used.\n * The tenancy modules should not be used here and it should be assumed that the tenancy context\n * has not yet been populated.\n */\nexport function authenticated(","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/middleware/authenticated.ts#L77-L113","documentation":"checkApiKey in the authenticated middleware validates the API key header against known users/tenants; when no matching user is found it throws InvalidAPIKeyWarning with code 'invalid_api_key'. The presented key is syntactically present but not recognized.","triggerScenarios":"Sending an API request with an api key header whose value does not match any stored key — revoked keys, wrong tenant, typo'd key, or an old key after regeneration.","commonSituations":"Rotating keys in the builder but the automation/integration still uses the old one; copying the wrong key between dev/prod tenants; trailing whitespace or quotes around the env-stored key.","solutions":["Regenerate/copy a fresh API key from the app/tenant settings and update the caller","Confirm the request targets the correct tenant (the key is tenant-scoped)","Trim whitespace/quotes from the key in env vars or CI secrets","Check the key wasn't revoked or deleted by another team member"],"exampleFix":"// before\nheaders: { \"x-api-key\": process.env.OLD_KEY }\n// after\nheaders: { \"x-api-key\": process.env.BUDIBASE_API_KEY?.trim() }","handlingStrategy":"try-catch","validationCode":"if (!apiKey || apiKey.trim().length < 10) throw new Error(\"Provide a valid Budibase API key\")","typeGuard":"function isValidApiKey(k: unknown): k is string {\n  return typeof k === \"string\" && k.trim().length > 0\n}","tryCatchPattern":"try {\n  const res = await api.get(\"/rows\", { headers: { \"x-api-key\": key } })\n} catch (e) {\n  if (e.code === \"invalid_api_key\") {\n    key = await fetchFreshApiKey() // regenerate and retry once\n  } else throw e\n}","preventionTips":["Store keys in one source of truth and update consumers on rotation","Scope keys per tenant and verify tenant on every call","Trim and strip quotes from keys read from env/CI secrets"],"tags":["authentication","api-key","middleware"],"backgroundTag":"invalid-api-key","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}