chocolatey/choco · error · ApplicationException

An API key was not found for '{0}'. You must either set an A

Error message

An API key was not found for '{0}'. You must either set an API key with the apikey command or specify one with --api-key.

What it means

Thrown by ChocolateyPushCommand.Validate when pushing to a remote (non-UNC, non-file) source and no API key is available. The command tries to look up a stored key via _configSettingsService.GetApiKey for the given source; if that returns null/empty and --api-key was not passed, authentication is impossible and the push is rejected.

Source

Thrown at src/chocolatey/infrastructure.app/commands/ChocolateyPushCommand.cs:92

                    throw new ApplicationException("The default push source configuration is not set. Either pass a source to push to, such as `--source=\"'{0}'\"`, or set the `defaultPushSource` configuration value, for example `choco config set --name=\"'defaultPushSource'\" --value=\"'{0}'\"`.".FormatWith(ApplicationParameters.ChocolateyCommunityFeedPushSource));
                }
            }

            IEnumerable<string> sources = configuration.Sources.Split(new[] { ";", "," }, StringSplitOptions.RemoveEmptyEntries);

            if (sources.Count() > 1)
            {
                throw new ApplicationException("Multiple sources are not supported by push command.");
            }

            var remoteSource = new Uri(configuration.Sources);
            if (string.IsNullOrWhiteSpace(configuration.PushCommand.Key) && !remoteSource.IsUnc && !remoteSource.IsFile)
            {
                // perform a lookup
                configuration.PushCommand.Key = _configSettingsService.GetApiKey(configuration, null);
                if (string.IsNullOrWhiteSpace(configuration.PushCommand.Key))
                {
                    throw new ApplicationException("An API key was not found for '{0}'. You must either set an API key with the apikey command or specify one with --api-key.".FormatWith(configuration.Sources));
                }
            }

            // security advisory
            if (!configuration.Force || configuration.Sources.ToLowerSafe().Contains("chocolatey.org"))
            {
                if (remoteSource.Scheme == "http" && remoteSource.Host != "localhost")
                {
                    var errorMessage =
                        @"WARNING! The specified source '{0}' is not secure.
 Sending apikey over insecure channels leaves your data susceptible to
 hackers. Please update your source to a more secure source and try again.

 Use --force if you understand the implications of this warning or are
 accessing an internal feed. If you are however doing this against an
 internet feed, then the choco gods think you are crazy. ;-)

NOTE: For chocolatey.org, you must update the source to be secure.".FormatWith(configuration.Sources);

View on GitHub (pinned to 0d5abdd10c)

Solutions

Store the key first: 'choco apikey --key="<your-api-key>" --source="https://push.chocolatey.org/"', then run 'choco push'.
Or pass the key inline: 'choco push --api-key="<your-api-key>" --source="https://push.chocolatey.org/"'.
In CI/CD, set the API key as an environment variable or pipeline secret and pass it via --api-key.
Verify the stored key matches the exact source URL: 'choco apikey'.

Example fix

// before
choco push --source="https://push.chocolatey.org/"
// after
choco apikey --key="abcd1234" --source="https://push.chocolatey.org/"
choco push --source="https://push.chocolatey.org/"

Defensive patterns

Strategy: validation

Validate before calling

// Ensure an API key is available before pushing
if (string.IsNullOrWhiteSpace(apiKey) && string.IsNullOrWhiteSpace(GetStoredApiKey(source)))
{
    Console.Error.WriteLine($"No API key for '{source}'. Set one with: choco apikey --key=<key> --source={source}");
}

Try / catch

try
{
    RunChoco($"push --source={source}");
}
catch (ApplicationException ex) when (ex.Message.Contains("API key was not found"))
{
    logger.Error("No API key configured. Run 'choco apikey' first.");
    // prompt user or fail the pipeline
}

Prevention

Store the API key with 'choco apikey --key=<key> --source=<url>' before pushing.
In CI/CD, pass --api-key from a secret variable.
Verify stored keys with 'choco apikey' periodically.

When it happens

Trigger: Running 'choco push' against a remote HTTPS feed without --api-key and without having previously stored a key via 'choco apikey'. The condition is: PushCommand.Key is empty AND source is not UNC AND source is not a file path AND GetApiKey returns empty.

Common situations: First push to the community feed or an internal feed without prior 'choco apikey -k <key> --source <source>'. Also in CI/CD pipelines where the API key was expected to be pre-configured but was not, or the stored key is for a different source URL.

Related errors

AI-assisted analysis of chocolatey/choco@0d5abdd10c (2026-08-13). Data as JSON: /api/errors/e031e066b910dc72. Report an issue: GitHub.