{"record":{"id":"f646bbe07947fb7e","repo":"weaviate/weaviate","slug":"keys-must-be-unique","errorCode":null,"errorMessage":"keys must be unique","messagePattern":"keys must be unique","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authentication/apikey/client.go","lineNumber":65,"sourceCode":"}\n\nfunc (c *StaticApiKey) validateConfig() error {\n\tif !c.config.Enabled {\n\t\t// don't validate if this scheme isn't used\n\t\treturn nil\n\t}\n\n\tif len(c.config.AllowedKeys) < 1 {\n\t\treturn fmt.Errorf(\"need at least one valid allowed key\")\n\t}\n\n\tseenKeys := make(map[string]struct{}, len(c.config.AllowedKeys))\n\tfor _, key := range c.config.AllowedKeys {\n\t\tif len(key) == 0 {\n\t\t\treturn fmt.Errorf(\"keys cannot have length 0\")\n\t\t}\n\t\tif _, ok := seenKeys[key]; ok {\n\t\t\treturn fmt.Errorf(\"keys must be unique\")\n\t\t}\n\t\tseenKeys[key] = struct{}{}\n\t}\n\n\tif len(c.config.Users) < 1 {\n\t\treturn fmt.Errorf(\"need at least one user\")\n\t}\n\n\tfor _, key := range c.config.Users {\n\t\tif len(key) == 0 {\n\t\t\treturn fmt.Errorf(\"users cannot have length 0\")\n\t\t}\n\t}\n\n\tif len(c.config.Users) > 1 && len(c.config.Users) != len(c.config.AllowedKeys) {\n\t\treturn fmt.Errorf(\"length of users and keys must match, alternatively provide single user for all keys\")\n\t}\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authentication/apikey/client.go#L47-L83","documentation":"Static API-key auth configuration lists the same key more than once in AllowedKeys. The duplicate check via seenKeys map fires during validation because duplicate keys would create ambiguous user-to-key mapping when Users are also configured. Usually a copy-paste or env-var concatenation mistake.","triggerScenarios":"The same key string appears twice in AUTHENTICATION_APIKEY_ALLOWED_KEYS, e.g. 'key1,key1' or copying an existing key when adding a second one while configuring multiple users.","commonSituations":"Copy-paste of an existing key in Helm values or docker-compose; automation generating keys that accidentally collides.","solutions":["Remove the duplicate entry so each key appears once","Generate distinct keys per user (e.g. openssl rand -hex 32)","If two users should share access, give them distinct keys or use a single user for all keys"],"exampleFix":"// before\nAUTHENTICATION_APIKEY_ALLOWED_KEYS=key1,key1\n// after\nAUTHENTICATION_APIKEY_ALLOWED_KEYS=key1,key2","handlingStrategy":"validation","validationCode":"seen := map[string]struct{}{}\nfor _, k := range strings.Split(os.Getenv(\"AUTHENTICATION_APIKEY_ALLOWED_KEYS\"), \",\") {\n  if _, dup := seen[k]; dup { return fmt.Errorf(\"duplicate api key in ALLOWED_KEYS\") }\n  seen[k] = struct{}{}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate each key uniquely per user","Never copy-paste existing keys when adding users","Run a config-duplication check in CI"],"tags":["go","authentication","configuration"],"backgroundTag":"invalid-apikey-config","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}