Server secret not set, datalake storage adapter initialized

Error message

Server secret not set, datalake storage adapter initialized with default secret

What it means

The Datalake storage adapter constructor reads the server secret from server token metadata (getMetadata(serverToken.metadata.Secret)). If no server secret is configured in the environment, it falls back to generating tokens with a default secret and prints this console warning. Tokens signed with the default secret are insecure and may be rejected by storage services expecting the real secret.

Source

Thrown at foundations/server/packages/datalake/src/index.ts:80

  retryCount?: number
  retryInterval?: number
}

/**
 * @public
 */
export class DatalakeService implements StorageAdapter {
  private readonly client: DatalakeClient
  private readonly retryCount: number
  private readonly retryInterval: number

  constructor (
    readonly cfg: DatalakeConfig,
    readonly options: DatalakeClientOptions = {}
  ) {
    const secret = getMetadata(serverToken.metadata.Secret)
    if (secret === undefined) {
      console.warn('Server secret not set, datalake storage adapter initialized with default secret')
    }
    const token = generateToken(systemAccountUuid, undefined)
    this.client = createDatalakeClient(cfg, token)
    this.retryCount = options.retryCount ?? 5
    this.retryInterval = options.retryInterval ?? 50
  }

  async initialize (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {}

  async close (): Promise<void> {}

  async exists (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<boolean> {
    // workspace/buckets not supported, assume that always exist
    return true
  }

  @withContext('make')
  async make (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {

View on GitHub (pinned to 63e28dc964)

Solutions

Set the server secret environment variable (e.g. SERVER_SECRET) before starting the server
Restart the process after setting the secret so the token metadata is populated
Verify with a startup check/log that getMetadata(serverToken.metadata.Secret) resolves
Never run production with the default secret — rotate any tokens issued while it was unset

Example fix

// before
docker run hcserver
// after
docker run -e SERVER_SECRET=<secret> hcserver

Defensive patterns

Strategy: validation

Validate before calling

if (process.env.SERVER_SECRET === undefined) {
  throw new Error('SERVER_SECRET must be set before initializing datalake adapter')
}

Type guard

function hasServerSecret(meta: { Secret?: string }): meta is { Secret: string } {
  return typeof meta.Secret === 'string' && meta.Secret.length > 0
}

Try / catch

try {
  const adapter = new DatalakeStorageAdapter(cfg)
  if (adapter.initializedWithDefaultSecret) logger.error('datalake using default secret — refusing in production')
} catch (err) {
  logger.error('datalake init failed', { err })
  process.exit(1)
}

Prevention

Fail fast at startup when SERVER_SECRET is missing in production
Add the secret to deployment templates/secret managers (k8s secrets, docker secrets)
Document required env vars in deployment README
Never commit default secrets; rotate tokens issued with defaults

When it happens

Trigger: Constructing the datalake storage adapter in a server process where the SERVER_SECRET (server token secret metadata) environment/config variable is undefined.

Common situations: Fresh deployment where the server secret env var was never set; running locally without copying the production env; docker-compose missing the secret entry; typo in the env variable name.

Related errors

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/1ae49108e01a06f3. Report an issue: GitHub.