bytedance/deer-flow · error · ValueError

Honcho backend: api_key over plain http requires backend_con

Error message

Honcho backend: api_key over plain http requires backend_config.allow_insecure_http: true (the key would be sent unencrypted). Use https, or set the opt-in for local development.

What it means

Raised by HonchoConfig.from_backend_config when an api_key is configured while base_url starts with http:// and allow_insecure_http is not true. The API key would be sent unencrypted in the Authorization header on every request, so the config parser rejects the combination unless the operator explicitly opts in for trusted local development (self-hosted Honcho commonly runs auth-less over plain HTTP, which stays allowed without an api_key).

Source

Thrown at backend/packages/harness/deerflow/agents/memory/backends/honcho/config.py:60

    user_peer_overrides: dict[str, str] = field(default_factory=dict)
    assistant_peer: str = "deerflow"
    timeout_seconds: float = 10.0
    connect_timeout_seconds: float = 3.0
    message_char_limit: int = 8000
    max_injection_chars: int = 6000
    allow_insecure_http: bool = False
    read_fail_closed: bool = False
    storage_path: str = ""

    @classmethod
    def from_backend_config(cls, backend_config: dict[str, Any] | None) -> HonchoConfig:
        cfg = dict(backend_config or {})
        failure_policy = cfg.get("failure_policy") or {}
        base_url = str(cfg.get("base_url", "http://localhost:8000")).rstrip("/")
        api_key = cfg.get("api_key") or None
        allow_insecure = bool(cfg.get("allow_insecure_http", False))
        if api_key and base_url.startswith("http://") and not allow_insecure:
            raise ValueError("Honcho backend: api_key over plain http requires backend_config.allow_insecure_http: true (the key would be sent unencrypted). Use https, or set the opt-in for local development.")
        return cls(
            base_url=base_url,
            api_key=api_key,
            workspace_prefix=str(cfg.get("workspace_prefix", "deerflow-u-")),
            workspace_overrides=_parse_override_map(cfg, "workspace_overrides"),
            user_peer_overrides=_parse_override_map(cfg, "user_peer_overrides"),
            assistant_peer=str(cfg.get("assistant_peer", "deerflow")),
            timeout_seconds=float(cfg.get("timeout_seconds", 10.0)),
            connect_timeout_seconds=float(cfg.get("connect_timeout_seconds", 3.0)),
            message_char_limit=int(cfg.get("message_char_limit", 8000)),
            max_injection_chars=int(cfg.get("max_injection_chars", 6000)),
            allow_insecure_http=allow_insecure,
            read_fail_closed=str(failure_policy.get("read", "")).lower() == "fail_closed",
            storage_path=str(cfg.get("storage_path") or ""),
        )

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Switch base_url to the https:// endpoint of your Honcho instance (e.g. https://demo.honcho.dev) — the key then travels encrypted
2. Remove api_key if the target Honcho is self-hosted auth-less over plain HTTP (the common local setup)
3. Only for trusted local development: keep http:// and add allow_insecure_http: true to backend_config

Example fix

# before (config.yaml)
memory:
  manager_class: honcho
  backend_config:
    base_url: http://localhost:8000
    api_key: "${HONCHO_API_KEY}"

# after
memory:
  manager_class: honcho
  backend_config:
    base_url: https://demo.honcho.dev
    api_key: "${HONCHO_API_KEY}"

from urllib.parse import urlsplit

def honcho_transport_ok(backend_config: dict) -> bool:
    base_url = str(backend_config.get("base_url", "http://localhost:8000"))
    has_key = bool(backend_config.get("api_key"))
    allows_insecure = bool(backend_config.get("allow_insecure_http", False))
    return not (has_key and urlsplit(base_url).scheme == "http" and not allows_insecure)

When it happens

Trigger: memory.backend_config with manager_class: honcho, api_key set (e.g. Honcho Cloud key) and base_url: http://localhost:8000 or any http:// URL, without allow_insecure_http: true. HonchoConfig.from_backend_config raises before any HTTP call is made.

Common situations: Pointing the default local base_url (http://localhost:8000) at a remote/managed Honcho that requires a key; starting with local HTTP and later adding a key without switching to https; corporate proxy that rewrites https to http.

Related errors

• Honcho request failed: POST {path}: {exc}
• Honcho returned non-JSON response: POST {path}: {exc}
• Honcho backend: {key}[{k!r}] has an empty value; remove the
• mem0 allow_insecure_http must be a boolean
• Failed to load MCP configuration

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/f741ab2e4b1f4d42. Report an issue: GitHub.