{"record":{"id":"e4a9d9a5e77187f3","repo":"langgenius/dify","slug":"auth-failed","errorCode":"auth_failed","errorMessage":"{message}","messagePattern":"\\{message\\}","errorType":"error_code","errorClass":"ApiKeyAuthFailedError","httpStatus":500,"severity":"error","filePath":"api/controllers/console/auth/data_source_bearer_auth.py","lineNumber":99,"sourceCode":"@console_ns.route(\"/api-key-auth/data-source/binding\")\nclass ApiKeyAuthDataSourceBinding(Resource):\n    @console_ns.response(200, \"Success\", console_ns.models[SimpleResultResponse.__name__])\n    @setup_required\n    @login_required\n    @account_initialization_required\n    @is_admin_or_owner_required\n    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_CREATE, resource_required=False)\n    @console_ns.expect(console_ns.models[ApiKeyAuthBindingPayload.__name__])\n    @with_current_tenant_id\n    @model_validate(ApiKeyAuthBindingPayload)\n    def post(self, req_data: ApiKeyAuthBindingPayload, current_tenant_id: str):\n        # The role of the current user in the table must be admin or owner\n        data = req_data.model_dump()\n        ApiKeyAuthService.validate_api_key_auth_args(data)\n        try:\n            ApiKeyAuthService.create_provider_auth(current_tenant_id, data, session=db.session())\n        except Exception as e:\n            raise ApiKeyAuthFailedError(str(e))\n        return {\"result\": \"success\"}, 200\n\n\n@console_ns.route(\"/api-key-auth/data-source/<uuid:binding_id>\")\nclass ApiKeyAuthDataSourceBindingDelete(Resource):\n    @setup_required\n    @login_required\n    @account_initialization_required\n    @is_admin_or_owner_required\n    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)\n    @console_ns.response(204, \"Binding deleted successfully\")\n    @with_current_tenant_id\n    def delete(self, current_tenant_id: str, binding_id: UUID):\n        # The role of the current user in the table must be admin or owner\n        ApiKeyAuthService.delete_provider_auth(current_tenant_id, str(binding_id), session=db.session())\n\n        return \"\", 204\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/data_source_bearer_auth.py#L81-L117","documentation":"Raised as ApiKeyAuthFailedError (code 'auth_failed') by POST /api-key-auth/data-source/binding when ApiKeyAuthService.create_provider_auth throws any exception. The original exception message is forwarded as the error message. This is the catch-all for upstream provider authentication failures when binding a data-source API key.","triggerScenarios":"POST /console/api/api-key-auth/data-source/binding where validate_api_key_auth_args passes but create_provider_auth fails — e.g. the external provider rejected the API key, network/SSRF error reaching the provider, or the provider credentials are malformed at the upstream layer.","commonSituations":"Wrong/expired/revoked upstream API key; provider endpoint changed or is unreachable; rate limited by the upstream provider; missing required fields for the specific provider; SSRF proxy blocks the provider's auth URL.","solutions":["Inspect the wrapped message returned in the error to identify the upstream cause (it is forwarded verbatim).","Re-enter the API key for the provider and confirm it is valid by testing it directly against the provider.","Check network/SSRF proxy connectivity to the provider's authentication endpoint.","Confirm all provider-specific required fields are present in the payload (after validate_api_key_auth_args)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await post('/api-key-auth/data-source/binding', payload);\n} catch (e) {\n  if (e.code === 'auth_failed') {\n    // surface e.message (upstream cause) to the user; offer to re-enter the key\n  } else { throw e; }\n}","preventionTips":["Validate provider credentials directly against the upstream before binding.","Confirm network/SSRF reachability to the provider's auth endpoint.","Send all provider-specific required fields; don't rely solely on the server's generic validation."],"tags":["api","auth","api-key","data-source","provider","credential"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}