What causes "Invalid workflow internal API credentials" in iflytek/astron-agent?

Set the identical WORKFLOW_INTERNAL_API_KEY value on both Agent and Workflow services and restart them

iflytek/astron-agent · error · HTTPException

Invalid workflow internal API credentials

Error message

Invalid workflow internal API credentials

What it means

require_workflow_internal_api_key() compares the caller-supplied credential against the configured shared key using secrets.compare_digest. If the header is missing or the value differs in any way, it raises HTTP 401 to reject the request at the Agent's workflow-internal endpoints.

Solutions

Set the identical WORKFLOW_INTERNAL_API_KEY value on both Agent and Workflow services and restart them
If using file-based secrets, strip trailing newlines (printf '%s' not echo) before injecting the header
Verify the caller actually sends the key header on every internal request
After rotation, redeploy both services together rather than one at a time

Example fix

// before
headers = {"Content-Type": "application/json"}
// after
headers = {"Content-Type": "application/json", "X-Internal-Api-Key": os.environ["WORKFLOW_INTERNAL_API_KEY"]}

Defensive patterns

Strategy: try-catch

Validate before calling

key = os.getenv("WORKFLOW_INTERNAL_API_KEY")
assert key and caller_key == key, "caller must send the exact shared internal key"

Type guard

def has_valid_internal_key(headers: dict, expected: str) -> bool:
    supplied = headers.get("X-Internal-Api-Key")
    return bool(supplied) and secrets.compare_digest(supplied, expected)

Try / catch

try:
    resp = await client.post(url, headers={"X-Internal-Api-Key": shared_key}, ...)
except httpx.HTTPStatusError as e:
    if e.response.status_code == 401:
        logger.error("internal key mismatch; check both services share the same WORKFLOW_INTERNAL_API_KEY")

Prevention

Rotate the shared key on both services simultaneously
Use printf '%s' when writing file-based secrets to avoid trailing newlines
Verify the header name matches what the server reads
Run an internal-auth health check after each deployment

When it happens

Trigger: Any Agent->Workflow or Workflow->Agent internal HTTP call that omits the key header or sends a value not byte-equal to the configured shared key (workflow_internal_auth.py:54).

Common situations: Caller service still using an old key after rotation; one service updated, the other not; whitespace/newline in the secret when injected from a mounted file; wrong header name; different keys set per environment by mistake.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/7456b35f9731b0f7. Report an issue: GitHub.

Appendix: source

Thrown at core/agent/infra/workflow_internal_auth.py:54

    if not api_key:
        raise HTTPException(
            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
            detail="Workflow internal API authentication is not configured",
        )
    return api_key


async def require_workflow_internal_api_key(
    supplied_api_key: Annotated[
        str | None, Security(_workflow_internal_api_key_header)
    ],
) -> None:
    """Require the same internal credential shared by Workflow and Agent."""
    expected_api_key = configured_workflow_internal_api_key()
    if not supplied_api_key or not secrets.compare_digest(
        supplied_api_key, expected_api_key
    ):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid workflow internal API credentials",
        )

View on GitHub (pinned to 5e758547a8)