{"record":{"id":"ea802f6b2ed8176d","repo":"Mintplex-Labs/anything-llm","slug":"no-valid-api-key-found-ea802f","errorCode":null,"errorMessage":"No valid API key found.","messagePattern":"No valid API key found\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/utils/middleware/validBrowserExtensionApiKey.js","lineNumber":14,"sourceCode":"const {\n  BrowserExtensionApiKey,\n} = require(\"../../models/browserExtensionApiKey\");\nconst { SystemSettings } = require(\"../../models/systemSettings\");\nconst { User } = require(\"../../models/user\");\n\nasync function validBrowserExtensionApiKey(request, response, next) {\n  const multiUserMode = await SystemSettings.isMultiUserMode();\n  response.locals.multiUserMode = multiUserMode;\n\n  const auth = request.header(\"Authorization\");\n  const bearerKey = auth ? auth.split(\" \")[1] : null;\n  if (!bearerKey) {\n    response.status(403).json({\n      error: \"No valid API key found.\",\n    });\n    return;\n  }\n\n  const apiKey = await BrowserExtensionApiKey.validate(bearerKey);\n  if (!apiKey) {\n    response.status(403).json({\n      error: \"No valid API key found.\",\n    });\n    return;\n  }\n\n  if (multiUserMode) {\n    const user = await User.get({ id: apiKey.user_id });\n    if (!user) {\n      response.status(403).json({\n        error: \"User not found.\",","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/validBrowserExtensionApiKey.js#L1-L32","documentation":"Auth guard in the validBrowserExtensionApiKey middleware: the Authorization header is missing or malformed (no bearer segment), so there is no browser-extension API key to validate and the request is refused with 403.","triggerScenarios":"Browser extension request made without a valid API key. Triggered when validBrowserExtensionApiKey middleware cannot validate the provided key (validBrowserExtensionApiKey.js:14).","commonSituations":"See trigger scenarios.","solutions":["Send the browser extension API key as a Bearer token in the Authorization header.","Create a valid browser extension API key via the extension connection flow and retry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}