What causes "Workflow internal API authentication is not configured" in iflytek/astron-agent?

Set the WORKFLOW_INTERNAL_API_KEY environment variable to a real key of at least 32 characters

iflytek/astron-agent · critical · CustomException

AGENT_NODE_EXECUTION_ERROR

AGENT_NODE_EXECUTION_ERROR

Error message

Workflow internal API authentication is not configured

What it means

Raised by AgentNode._build_agent_request_headers (via _call_agent) when no internal API key can be resolved from WORKFLOW_INTERNAL_API_KEY or WORKFLOW_INTERNAL_API_KEY_FILE (with min length 32 and not the placeholder value). Agent nodes call an internal agent API that requires this key for authentication; without it the request would fail downstream, so the node fails fast with AGENT_NODE_EXECUTION_ERROR.

Solutions

Set the WORKFLOW_INTERNAL_API_KEY environment variable to a real key of at least 32 characters
If using key files, point WORKFLOW_INTERNAL_API_KEY_FILE at an existing readable file containing the key and remove the env-var placeholder
Regenerate the key if it is still the placeholder value (WORKFLOW_INTERNAL_API_KEY_PLACEHOLDER)
Add the secret to your docker-compose/helm values and restart the workflow service

Example fix

// before (docker-compose)
# no key configured
// after (docker-compose)
environment:
  - WORKFLOW_INTERNAL_API_KEY=openssl-rand-hex-32-output-value

Defensive patterns

Strategy: validation

Validate before calling

import os
def internal_api_key_ready() -> bool:
    key = os.environ.get("WORKFLOW_INTERNAL_API_KEY")
    return bool(key) and len(key) >= 32

Try / catch

try:
    await agent_node.async_execute(...)
except CustomException as e:
    if "authentication is not configured" in (e.err_msg or ""):
        raise RuntimeError("Set WORKFLOW_INTERNAL_API_KEY before running agent nodes") from e
    raise

Prevention

Add WORKFLOW_INTERNAL_API_KEY to deployment checklists and startup health checks
Fail fast at service startup if the key is missing rather than at node execution
Never commit placeholder keys; inject real secrets via docker/helm

When it happens

Trigger: Executing a workflow containing an agent node in an environment where WORKFLOW_INTERNAL_API_KEY env var is unset, the key file is missing, the key is shorter than 32 chars, or it still equals the deployment placeholder value.

Common situations: Deploying with docker/helm without injecting the WORKFLOW_INTERNAL_API_KEY secret; local dev environments that skip the secret setup; mounting the wrong secret file path; copying an example placeholder key from docs.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/f08fd4a3c6bcbf1b. Report an issue: GitHub.

Appendix: source

Thrown at core/workflow/engine/nodes/agent/agent_node.py:287

    metaData: AgentMetaData = AgentMetaData()
    maxLoopCount: int = Field(...)
    stream: bool = Field(default=True)
    maxTokens: int = Field(default=10240)
    enableChatHistoryV2: EnableChatHistoryV2 = Field(
        default_factory=EnableChatHistoryV2
    )
    source: str = Field(default=ModelProviderEnum.XINGHUO.value)

    def _build_agent_request_headers(self) -> dict[str, str]:
        """Build an authenticated request for the deployment-internal Agent API."""
        internal_api_key = credential_from_env_or_file(
            "WORKFLOW_INTERNAL_API_KEY",
            "WORKFLOW_INTERNAL_API_KEY_FILE",
            min_length=32,
            placeholders=(WORKFLOW_INTERNAL_API_KEY_PLACEHOLDER,),
        )
        if not internal_api_key:
            raise CustomException(
                err_code=CodeEnum.AGENT_NODE_EXECUTION_ERROR,
                err_msg="Workflow internal API authentication is not configured",
            )
        headers = {
            "Content-Type": "application/json",
            "x-consumer-username": self.appId,
            WORKFLOW_INTERNAL_API_KEY_HEADER: internal_api_key,
        }
        headers.update(
            inject_trusted_langfuse_context(
                method="POST",
                audience=AGENT_TRACE_AUDIENCE,
                tenant_id=self.appId,
            )
        )
        return headers

    async def _call_agent(

View on GitHub (pinned to 5e758547a8)