crewAIInc/crewAI · error · ValueError

Project name cannot be empty or contain only whitespace

Error message

Project name cannot be empty or contain only whitespace

What it means

Raised as HTTP 401 by APIKeyServerAuth when the presented API key does not byte-equal the key configured on the server. The server stores the key as a SecretStr and compares the raw token string; any mismatch (wrong key, whitespace, encoding) rejects the request.

Source

Thrown at lib/cli/src/crewai_cli/create_crew.py:55

    template_content = template_content.replace("{{name}}", "placeholder")
    template_content = template_content.replace("{{crew_name}}", "Placeholder")

    template_data = tomli.loads(template_content)
    script_names = set(template_data.get("project", {}).get("scripts", {}).keys())
    script_names.discard("_placeholder_")
    return script_names


def create_folder_structure(
    name: str, parent_folder: str | None = None
) -> tuple[Path, str, str]:
    import keyword
    import re

    name = name.rstrip("/")

    if not name.strip():
        raise ValueError("Project name cannot be empty or contain only whitespace")

    folder_name = name.replace(" ", "_").replace("-", "_").lower()
    folder_name = re.sub(r"[^a-zA-Z0-9_]", "", folder_name)

    if re.match(r"^[^a-zA-Z0-9_-]+", name):
        raise ValueError(
            f"Project name '{name}' contains no valid characters for a Python module name"
        )

    if not folder_name:
        raise ValueError(
            f"Project name '{name}' contains no valid characters for a Python module name"
        )

    if folder_name[0].isdigit():
        raise ValueError(
            f"Project name '{name}' would generate folder name '{folder_name}' which cannot start with a digit (invalid Python module name)"
        )

View on GitHub (pinned to 754d7323be)

Solutions

  1. Confirm the exact key value on both sides: compare os.environ value hashes rather than eyeballing, and strip whitespace when loading (os.environ['API_KEY'].strip())
  2. Check the key belongs to the same environment (staging key against prod server fails)
  3. After a key rotation, update the client's configured key and restart the process so cached configs reload
  4. Verify the client sends the key in the header scheme the server expects (e.g. X-API-Key vs Authorization), since a missing/misplaced key can surface as this 401

Example fix

# before
APIKeyServerAuth(api_key=SecretStr('"abc123"'))  # quotes kept in value

# after
APIKeyServerAuth(api_key=SecretStr(os.environ['A2A_API_KEY'].strip()))
Defensive patterns

Strategy: validation

Validate before calling

import os

def load_api_key() -> str:
    key = os.environ.get("A2A_API_KEY", "").strip()
    if not key or key.startswith(('"', "'")):
        raise RuntimeError("A2A_API_KEY unset, empty, or includes quote characters")
    return key

Try / catch

from fastapi import HTTPException

try:
    user = await scheme.authenticate(request)
except HTTPException as e:
    if e.status_code == 401:
        log_and_alert("API key rejected — verify key rotation on both sides")
    raise

Prevention

When it happens

Trigger: Calling an A2A endpoint protected by APIKeyServerAuth(api_key=SecretStr(...)) with a token that differs from the configured value: wrong environment's key, key rotated on the server but not the client, key copied with leading/trailing whitespace or quotes, or key sent via the wrong header name.

Common situations: Separate staging/production keys mixed up in .env files; key rotated during incident response; CI secret injected with a trailing newline; API key configured with quotes included in the value.

Related errors


AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/bf7e51b4d77468d7. Report an issue: GitHub.