iflytek/astron-agent · error · ValueError

Both API key and secret must be provided for ifly…

Error message

Both API key and secret must be provided for ifly authentication, or neither.

What it means

The same validator enforces that ifly/ifly-v2 authentication is all-or-nothing: api_key and api_secret must both be set or both be empty. Providing exactly one fails validation at startup, since asymmetric credentials cannot authenticate against the iFly backend.

Solutions

Provide both CODE_EXEC_API_KEY and CODE_EXEC_API_SECRET
Or remove both to run unauthenticated (if permitted by the endpoint)
Check env overlays/secrets so one value isn't being emptied during deployment
Re-run the validator mentally against your final merged config, not just one source

Example fix

// before
CODE_EXEC_API_KEY=abc123
# secret missing
// after
CODE_EXEC_API_KEY=abc123
CODE_EXEC_API_SECRET=xyz789

Defensive patterns

Strategy: validation

Validate before calling

if exec_type in ("ifly", "ifly-v2") and bool(api_key) != bool(api_secret):
    raise ValueError("Both API key and secret must be provided, or neither")

Try / catch

try:
    AppConfig()
except ValidationError as e:
    logger.error("incomplete ifly credentials: %s", e)
    sys.exit(2)

Prevention

Store key+secret as a pair in the same secret object
Rotate credentials together
Keep both values in one env overlay to avoid partial overrides

When it happens

Trigger: Setting CODE_EXEC_API_KEY without CODE_EXEC_API_SECRET (or vice versa) while exec_type is ifly/ifly-v2; one secret accidentally overridden to empty in an env overlay.

Common situations: Partial credential rotation in k8s secrets; pasting only the key from the iFly console and missing the secret field; config templates with one of the two fields commented out.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/d0d3d4706b14dcdc. Report an issue: GitHub.

Appendix: source

Thrown at core/workflow/configs/app_config.py:322

            raise ValueError(
                "CODE_EXEC_MEMORY_LIMIT_MB must be between "
                f"{MIN_CODE_EXEC_MEMORY_LIMIT_MB} and "
                f"{MAX_CODE_EXEC_MEMORY_LIMIT_MB} MB"
            )
        return v

    @model_validator(mode="after")
    def validator_url(self) -> "CodeExecutorConfig":
        """
        Validate the URL.

        :return: The validated URL
        """
        if self.exec_type in ["ifly", "ifly-v2"]:
            if not self.url:
                raise ValueError("URL is required for ifly or ifly-v2")
            if bool(self.api_key) != bool(self.api_secret):
                raise ValueError(
                    "Both API key and secret must be provided for ifly authentication, or neither."
                )
        return self


class DatabaseConfig(BaseSettings):
    """
    Database connection configuration.

    Loads MySQL connection parameters from environment variables
    (MYSQL_HOST, MYSQL_PORT, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB).
    """

    model_config = {"env_prefix": "", "case_sensitive": False}

    host: str = Field(default="", alias="MYSQL_HOST")
    port: str = Field(default="", alias="MYSQL_PORT")
    user: str = Field(default="", alias="MYSQL_USER")

View on GitHub (pinned to 5e758547a8)