getredash/redash · critical · Exception

You must set the REDASH_COOKIE_SECRET environment variable.

Error message

You must set the REDASH_COOKIE_SECRET environment variable. Visit http://redash.io/help/open-source/admin-guide/secrets for more information.

What it means

Raised at import time of redash.settings (redash/settings/__init__.py:62) when the REDASH_COOKIE_SECRET environment variable is not set. This secret signs Flask session cookies; because it is security-critical, Redash refuses to start without it and points to the official secrets documentation.

Source

Thrown at redash/settings/__init__.py:62

QUERY_RESULTS_CLEANUP_ENABLED = parse_boolean(os.environ.get("REDASH_QUERY_RESULTS_CLEANUP_ENABLED", "true"))
QUERY_RESULTS_CLEANUP_COUNT = int(os.environ.get("REDASH_QUERY_RESULTS_CLEANUP_COUNT", "100"))
QUERY_RESULTS_CLEANUP_MAX_AGE = int(os.environ.get("REDASH_QUERY_RESULTS_CLEANUP_MAX_AGE", "7"))

QUERY_RESULTS_EXPIRED_TTL_ENABLED = parse_boolean(os.environ.get("REDASH_QUERY_RESULTS_EXPIRED_TTL_ENABLED", "false"))
# default set query results expired ttl 86400 seconds
QUERY_RESULTS_EXPIRED_TTL = int(os.environ.get("REDASH_QUERY_RESULTS_EXPIRED_TTL", "86400"))

SCHEMAS_REFRESH_SCHEDULE = int(os.environ.get("REDASH_SCHEMAS_REFRESH_SCHEDULE", 30))
SCHEMAS_REFRESH_TIMEOUT = int(os.environ.get("REDASH_SCHEMAS_REFRESH_TIMEOUT", 300))

AUTH_TYPE = os.environ.get("REDASH_AUTH_TYPE", "api_key")
INVITATION_TOKEN_MAX_AGE = int(os.environ.get("REDASH_INVITATION_TOKEN_MAX_AGE", 60 * 60 * 24 * 7))

# The secret key to use in the Flask app for various cryptographic features
SECRET_KEY = os.environ.get("REDASH_COOKIE_SECRET")

if SECRET_KEY is None:
    raise Exception(
        "You must set the REDASH_COOKIE_SECRET environment variable. Visit http://redash.io/help/open-source/admin-guide/secrets for more information."
    )

# The secret key to use when encrypting data source options
DATASOURCE_SECRET_KEY = os.environ.get("REDASH_SECRET_KEY", SECRET_KEY)

# Whether and how to redirect non-HTTP requests to HTTPS. Disabled by default.
ENFORCE_HTTPS = parse_boolean(os.environ.get("REDASH_ENFORCE_HTTPS", "false"))
ENFORCE_HTTPS_PERMANENT = parse_boolean(os.environ.get("REDASH_ENFORCE_HTTPS_PERMANENT", "false"))
# Whether file downloads are enforced or not.
ENFORCE_FILE_SAVE = parse_boolean(os.environ.get("REDASH_ENFORCE_FILE_SAVE", "true"))

# Whether api calls using the json query runner will block private addresses
ENFORCE_PRIVATE_ADDRESS_BLOCK = parse_boolean(os.environ.get("REDASH_ENFORCE_PRIVATE_IP_BLOCK", "true"))

# Whether to use secure cookies by default.
COOKIES_SECURE = parse_boolean(os.environ.get("REDASH_COOKIES_SECURE", str(ENFORCE_HTTPS)))
# Whether the session cookie is set to secure.

View on GitHub (pinned to ca79fe988d)

Solutions

1. Generate a strong value: `openssl rand -base64 32` and export REDASH_COOKIE_SECRET=<value> in the server's environment (.env for docker-compose, systemd Environment=, k8s Secret)
2. Keep the same value across restarts and all server/worker processes, otherwise sessions/CSRF tokens invalidate
3. If REDASH_SECRET_KEY (datasource encryption key) is also unset, set it too to avoid a fallback coupling to the cookie secret
4. For local dev/tests, put the variable in a sourced .env or conftest setup

Example fix

# before
$ python manage.py db upgrade
Exception: You must set the REDASH_COOKIE_SECRET ...
# after
$ export REDASH_COOKIE_SECRET=$(openssl rand -base64 32)
$ python manage.py db upgrade

import os
assert os.environ.get('REDASH_COOKIE_SECRET'), 'REDASH_COOKIE_SECRET must be set before boot'

When it happens

Trigger: Starting the Redash server or worker (or importing redash.settings, as tests do) in any environment where REDASH_COOKIE_SECRET is unset — fresh installs, new containers/services, CI, or after a dotenv/overrides file stopped being loaded.

Common situations: New docker-compose deployment where the env var was never added to .env; systemd unit or Kubernetes manifest missing the variable; running management commands in a shell without the project's env activated.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Invalid boolean value %r
• Username and Password required
• Azure AD Client ID, Client Secret, and Tenant ID are require
• Scripts can only be run from the configured scripts director
• Neither password nor private_key_b64 is set.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/2e252fa9c043c2f1. Report an issue: GitHub.