{"record":{"id":"d7d0aac1a2729f52","repo":"router-for-me/CLIProxyAPI","slug":"plugin-store-auth-env-s-is-empty","errorCode":null,"errorMessage":"plugin store auth env %s is empty","messagePattern":"plugin store auth env (.+?) is empty","errorType":"http","errorClass":null,"httpStatus":502,"severity":"error","filePath":"internal/pluginstore/auth.go","lineNumber":468,"sourceCode":"\tif len(item.ApplyTo) == 0 {\n\t\treturn true\n\t}\n\tfor _, value := range item.ApplyTo {\n\t\tif strings.EqualFold(strings.TrimSpace(value), kind) {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\nfunc envValueRequired(envName string, field string) (string, error) {\n\tenvName = strings.TrimSpace(envName)\n\tif envName == \"\" {\n\t\treturn \"\", fmt.Errorf(\"plugin store auth missing %s\", field)\n\t}\n\tvalue := strings.TrimSpace(os.Getenv(envName))\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"plugin store auth env %s is empty\", envName)\n\t}\n\treturn value, nil\n}\n","sourceCodeStart":450,"sourceCodeEnd":472,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/pluginstore/auth.go#L450-L472","documentation":"The env var named by an auth rule's *-env field is unset or contains only whitespace in the process environment (envValueRequired trims the value). The rule is structurally valid but the secret itself is missing at resolution time, so the store cannot build the Authorization header. Distinct from error 594, which fires when the env var *name* is missing.","triggerScenarios":"token-env: PLUGIN_TOKEN is configured, but PLUGIN_TOKEN is not set in the environment of the running CLIProxyAPI process when a matching store request resolves auth.","commonSituations":"Var set in the developer shell but not in the systemd unit/Docker container/k8s deployment; .env not loaded because the service runs from a different working directory; typo in the variable name; secret removed during rotation.","solutions":["Export the variable in the environment that actually runs the process (systemd Environment=, docker -e, .env beside config.yaml)","Check the variable name in config matches exactly (case-sensitive) what is set","Restart the service after adding the variable","For k8s/containers, verify the secret is mounted into env, not just a file"],"exampleFix":"# before (systemd unit)\n[Service]\nEnvironment=PLUGIN_TOKEN=\n\n# after\n[Service]\nEnvironment=PLUGIN_TOKEN=actual-token","handlingStrategy":"validation","validationCode":"func allAuthEnvsSet(rules []AuthConfig) error {\n    for _, r := range rules {\n        for _, name := range []string{r.TokenEnv, r.UsernameEnv, r.PasswordEnv, r.HeaderValueEnv} {\n            if strings.TrimSpace(name) != \"\" && strings.TrimSpace(os.Getenv(name)) == \"\" {\n                return fmt.Errorf(\"required env %s is not set\", name)\n            }\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Preflight all required env vars at process start and fail loudly","Keep .env next to config.yaml and run the service from that directory so auto-load applies","In containers, inject secrets via the orchestrator's secret mechanism, not baked images"],"tags":["env","auth","secrets","plugin-store"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}