gofr-dev/gofr · error

api keys list is empty

Error message

api keys list is empty

What it means

errAPIKeyEmpty is returned by NewAPIKeyAuthProvider in GoFr's HTTP middleware when the provided API keys map/slice has no entries. The auth middleware cannot validate any request without at least one key, so construction fails fast. It is a configuration-time error, not a runtime request error.

Source

Thrown at pkg/gofr/http/middleware/apikey_auth.go:14

// Package middleware provides a collection of middleware functions that handles various aspects of request handling,
// such as authentication, logging, tracing, and metrics collection.
package middleware

import (
	"crypto/subtle"
	"errors"
	"net/http"

	"gofr.dev/pkg/gofr/container"
)

var (
	errAPIKeyEmpty = errors.New("api keys list is empty")
)

// APIKeyAuthProvider represents a basic authentication provider.
type APIKeyAuthProvider struct {
	ValidateFunc                func(apiKey string) bool
	ValidateFuncWithDatasources func(c *container.Container, apiKey string) bool
	Container                   *container.Container
	APIKeys                     []string
}

// NewAPIKeyAuthProvider instantiates an instance of type AuthProvider interface.
func NewAPIKeyAuthProvider(apiKeys []string) (AuthProvider, error) {
	if len(apiKeys) == 0 {
		return nil, errAPIKeyEmpty
	}

	return &APIKeyAuthProvider{APIKeys: apiKeys}, nil
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Pass a non-empty map/slice of valid API keys to NewAPIKeyAuthProvider
2. Verify the env var or config source supplying the keys is set and parsed (e.g. strings.Split produces elements)
3. Add a startup-time config check so the service fails loudly before wiring middleware
4. Add a unit test that constructs the provider with your production config shape

Example fix

// before
provider, err := middleware.NewAPIKeyAuthProvider(map[string]string{}) // errAPIKeyEmpty
// after
keys := map[string]string{"admin": os.Getenv("ADMIN_API_KEY")}
if len(keys["admin"]) == 0 { log.Fatal("ADMIN_API_KEY not set") }
provider, err := middleware.NewAPIKeyAuthProvider(keys)

if len(apiKeys) == 0 {
    return fmt.Errorf("invalid config: api keys list must not be empty before calling NewAPIKeyAuthProvider")
}

func hasAPIKeys(keys map[string]string) bool { return len(keys) > 0 }

provider, err := middleware.NewAPIKeyAuthProvider(keys)
if err != nil {
    log.Fatalf("API key auth not configured: %v", err) // fail fast at startup
}

When it happens

Trigger: Calling NewAPIKeyAuthProvider(nil) or NewAPIKeyAuthProvider with an empty map/slice of API keys.

Common situations: Reading API keys from an environment variable or config that is unset/empty, accidentally clearing the keys list after refactoring, or wiring the auth middleware before configuration is loaded.

Related errors

• validate func is empty
• user list is empty
• container is nil
• require non-empty provider
• invalid interval, require a value greater than 1 second

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/f0f205de06555356. Report an issue: GitHub.