{"record":{"id":"f08fd4a3c6bcbf1b","repo":"iflytek/astron-agent","slug":"agent-node-execution-error","errorCode":"AGENT_NODE_EXECUTION_ERROR","errorMessage":"Workflow internal API authentication is not configured","messagePattern":"Workflow internal API authentication is not configured","errorType":"error_code","errorClass":"CustomException","httpStatus":null,"severity":"critical","filePath":"core/workflow/engine/nodes/agent/agent_node.py","lineNumber":287,"sourceCode":"    metaData: AgentMetaData = AgentMetaData()\n    maxLoopCount: int = Field(...)\n    stream: bool = Field(default=True)\n    maxTokens: int = Field(default=10240)\n    enableChatHistoryV2: EnableChatHistoryV2 = Field(\n        default_factory=EnableChatHistoryV2\n    )\n    source: str = Field(default=ModelProviderEnum.XINGHUO.value)\n\n    def _build_agent_request_headers(self) -> dict[str, str]:\n        \"\"\"Build an authenticated request for the deployment-internal Agent API.\"\"\"\n        internal_api_key = credential_from_env_or_file(\n            \"WORKFLOW_INTERNAL_API_KEY\",\n            \"WORKFLOW_INTERNAL_API_KEY_FILE\",\n            min_length=32,\n            placeholders=(WORKFLOW_INTERNAL_API_KEY_PLACEHOLDER,),\n        )\n        if not internal_api_key:\n            raise CustomException(\n                err_code=CodeEnum.AGENT_NODE_EXECUTION_ERROR,\n                err_msg=\"Workflow internal API authentication is not configured\",\n            )\n        headers = {\n            \"Content-Type\": \"application/json\",\n            \"x-consumer-username\": self.appId,\n            WORKFLOW_INTERNAL_API_KEY_HEADER: internal_api_key,\n        }\n        headers.update(\n            inject_trusted_langfuse_context(\n                method=\"POST\",\n                audience=AGENT_TRACE_AUDIENCE,\n                tenant_id=self.appId,\n            )\n        )\n        return headers\n\n    async def _call_agent(","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/workflow/engine/nodes/agent/agent_node.py#L269-L305","documentation":"Raised by AgentNode._build_agent_request_headers (via _call_agent) when no internal API key can be resolved from WORKFLOW_INTERNAL_API_KEY or WORKFLOW_INTERNAL_API_KEY_FILE (with min length 32 and not the placeholder value). Agent nodes call an internal agent API that requires this key for authentication; without it the request would fail downstream, so the node fails fast with AGENT_NODE_EXECUTION_ERROR.","triggerScenarios":"Executing a workflow containing an agent node in an environment where WORKFLOW_INTERNAL_API_KEY env var is unset, the key file is missing, the key is shorter than 32 chars, or it still equals the deployment placeholder value.","commonSituations":"Deploying with docker/helm without injecting the WORKFLOW_INTERNAL_API_KEY secret; local dev environments that skip the secret setup; mounting the wrong secret file path; copying an example placeholder key from docs.","solutions":["Set the WORKFLOW_INTERNAL_API_KEY environment variable to a real key of at least 32 characters","If using key files, point WORKFLOW_INTERNAL_API_KEY_FILE at an existing readable file containing the key and remove the env-var placeholder","Regenerate the key if it is still the placeholder value (WORKFLOW_INTERNAL_API_KEY_PLACEHOLDER)","Add the secret to your docker-compose/helm values and restart the workflow service"],"exampleFix":"// before (docker-compose)\n# no key configured\n// after (docker-compose)\nenvironment:\n  - WORKFLOW_INTERNAL_API_KEY=openssl-rand-hex-32-output-value","handlingStrategy":"validation","validationCode":"import os\ndef internal_api_key_ready() -> bool:\n    key = os.environ.get(\"WORKFLOW_INTERNAL_API_KEY\")\n    return bool(key) and len(key) >= 32","typeGuard":null,"tryCatchPattern":"try:\n    await agent_node.async_execute(...)\nexcept CustomException as e:\n    if \"authentication is not configured\" in (e.err_msg or \"\"):\n        raise RuntimeError(\"Set WORKFLOW_INTERNAL_API_KEY before running agent nodes\") from e\n    raise","preventionTips":["Add WORKFLOW_INTERNAL_API_KEY to deployment checklists and startup health checks","Fail fast at service startup if the key is missing rather than at node execution","Never commit placeholder keys; inject real secrets via docker/helm"],"tags":["config","authentication","env-var","agent-node"],"backgroundTag":"missing-env-var","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}