iflytek/astron-agent · warning

api_key must not been empty

Error message

api_key must not been empty

What it means

newDeleteAuthReq validates the DeleteAuth request body before the handler proceeds. When req.ApiKey is an empty string it returns this error, since identifying which app credential to delete requires a non-empty api_key. This is an input validation guard, not an infrastructure failure.

Solutions

1. Include a non-empty api_key field in the request JSON body
2. Check client-side that the API key value is loaded (not an unset env var) before calling the endpoint
3. Return a 400 with this message from the handler so callers see the missing field explicitly

Example fix

// before
curl -X POST .../auth/delete -d '{"app_id":"app1"}'
// after
curl -X POST .../auth/delete -d '{"app_id":"app1","api_key":"ak-123"}'

if !req || req.AppId == "" || req.ApiKey == "" { return errors.New("app_id and api_key are required") }

When it happens

Trigger: POST/DELETE requests routed to DeleteAuth whose JSON body omits api_key or sets it to ""; tests calling newDeleteAuthReq with an empty ApiKey field.

Common situations: Client sends a JSON body that names the field differently (apiKey vs api_key due to missing binding tag handling), body truncated by a proxy, or a caller constructing the struct in Go without setting ApiKey.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• api_secret must not been empty
• app_id must not been empty
• app_name must not been empty
• cloud_id must not been empty
• dev_id must been more than zero

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/c72a628b4b60d8f8. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/internal/handler/req.go:195

	RequestId string `json:"request_id"`
	AppId     string `json:"app_id"`
	ApiKey    string `json:"api_key"`
}

func newDeleteAuthReq(c *gin.Context) (*DeleteAuthReq, error) {
	req := &DeleteAuthReq{}
	err := c.BindJSON(req)
	if err != nil {
		return nil, err
	}
	if len(req.RequestId) == 0 {
		return nil, errors.New("request_id must not been empty")
	}
	if len(req.AppId) == 0 {
		return nil, errors.New("app_id must not been empty")
	}
	if len(req.ApiKey) == 0 {
		return nil, errors.New("api_key must not been empty")
	}
	return req, nil
}

type VerifyAppAuthReq struct {
	ApiKey    string `json:"api_key"`
	ApiSecret string `json:"api_secret"`
}

func newVerifyAppAuthReq(c *gin.Context) (*VerifyAppAuthReq, error) {
	req := &VerifyAppAuthReq{}
	err := c.BindJSON(req)
	if err != nil {
		return nil, err
	}
	if len(req.ApiKey) == 0 {
		return nil, errors.New("api_key must not been empty")
	}

View on GitHub (pinned to 5e758547a8)