flarum/framework · error · ValidationException

flarum-akismet.admin.akismet_settings.invalid_api_key_messag…

Error message

flarum-akismet.admin.akismet_settings.invalid_api_key_message

What it means

The flarum/akismet extension validates the Akismet API key when admin settings are saved by calling the Akismet service; if verification fails or returns false, it throws a ValidationException with a translated message so the settings form rejects the key. It is thrown from ValidateApiKey::handle during settings save.

Solutions

Verify the Akismet API key is valid and active for your site (check akismet.com account).
Test outbound connectivity from the server to rest.akismet.com (curl https://rest.akismet.com/1.1/verify-key).
Ensure php curl/openssl extensions and CA certificates are installed so HTTPS verification works.
If you want to save an unverified key, check the server log — verification failures are logged as a warning and the save proceeds.
Re-save with a correct key after fixing network or account issues.

Example fix

// before
'flarum-akismet.api_key' => 'YOUR_API_KEY'
// after
'flarum-akismet.api_key' => 'a1b2c3d4e5f6' // key verified via akismet.com/1.1/verify-key

Defensive patterns

Strategy: validation

Validate before calling

$valid = (new Akismet($apiKey, $siteUrl))->verifyKey(); if (! $valid) { // block save / show error }

Try / catch

try { $service->verifyApiKey($key); } catch (ValidationException $e) { flash($e->getErrors()['flarum-akismet.api_key'][0]); }

Prevention

Verify the key on akismet.com before configuring
Check server outbound HTTPS connectivity to rest.akismet.com
Keep a test command/harness to verify keys out-of-band

When it happens

Trigger: Saving the akismet admin settings (POST to the settings endpoint) while the configured flarum-akismet.api_key is empty, malformed, revoked, or the Akismet API is unreachable/returns an error so the key cannot be verified.

Common situations: Typing a wrong or placeholder key into the admin panel; an Akismet account whose key was deactivated; the server cannot reach rest.akismet.com (firewall, DNS, missing TLS CA certs); key from a different blog URL than the configured site URL.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/3ac4be35f28ce1f5. Report an issue: GitHub.

Appendix: source

Thrown at extensions/akismet/src/Listener/ValidateApiKey.php:54

        $key = Arr::get($event->settings, 'flarum-akismet.api_key');

        // Not part of this save, or deliberately being cleared.
        if ($key === null || $key === '') {
            return;
        }

        try {
            $valid = $this->akismet->verifyKey($key);
        } catch (GuzzleException $e) {
            // Can't reach Akismet right now — don't block the admin from
            // saving; a wrong key will still surface in the log on use.
            $this->log->warning("[flarum/akismet] Could not verify the API key, saving unverified: {$e->getMessage()}");

            return;
        }

        if (! $valid) {
            throw new ValidationException([
                'flarum-akismet.api_key' => $this->translator->trans('flarum-akismet.admin.akismet_settings.invalid_api_key_message'),
            ]);
        }
    }
}

View on GitHub (pinned to 4b939f6853)