What causes "ResponseEnum.MODEL_API_KEY_NOT_FOUND" in iflytek/astron-agent?

Insert a config_info row with the correct category, code='private key', is_valid=1, and value=PEM private key.

iflytek/astron-agent · critical · BusinessException

MODEL_API_KEY_NOT_FOUND

MODEL_API_KEY_NOT_FOUND

Error message

ResponseEnum.MODEL_API_KEY_NOT_FOUND

What it means

loadPrivateKey throws MODEL_API_KEY_NOT_FOUND when no valid config_info row exists with category=model secret key and code=private key (is_valid=1). The service cannot even attempt decryption because the RSA private key is missing from configuration.

Solutions

Insert a config_info row with the correct category, code='private key', is_valid=1, and value=PEM private key.
Verify the environment's config_info table is seeded (check deploy/init SQL or config management).
If the key was rotated, insert the new private key row rather than only invalidating the old one.

Example fix

-- before: no row
-- after
INSERT INTO config_info (category, code, value, is_valid)
VALUES ('model_secret_key', 'private_key', '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----', 1);

Defensive patterns

Strategy: try-catch

Validate before calling

SELECT COUNT(*) FROM config_info WHERE category='model_secret_key' AND code='private_key' AND is_valid=1; // must be >= 1

Try / catch

try { svc.decryptApiKey(ct); } catch (BusinessException e) { if (e.getCode() == ResponseEnum.MODEL_API_KEY_NOT_FOUND) { alertOpsToSeedPrivateKeyConfig(); } }

Prevention

Seed the private-key config row in every environment's init/迁移 SQL.
Never invalidate the old key row until the new one is inserted.
Add a health check that the private key config resolves at startup.

When it happens

Trigger: Any decrypt attempt when the private-key row is absent from config_info, is invalid (is_valid=0), or the category/code strings don't match the constants CAT_MODEL_SECRET_KEY / CODE_PRIVATE_KEY.

Common situations: Fresh environment where the config table was never seeded; key row soft-invalidated during rotation without inserting the new one; wrong environment database (key only exists in prod).

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/0c5c9ffb81f6288d. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/agentmemory/runtime/AgentMemorySecretService.java:65

            privateKey = cachedPrivateKey;
            if (privateKey != null && now < privateKeyCacheExpiresAt) {
                return privateKey;
            }
            privateKey = loadPrivateKey();
            cachedPrivateKey = privateKey;
            privateKeyCacheExpiresAt = System.currentTimeMillis() + PRIVATE_KEY_CACHE_TTL_MS;
            return privateKey;
        }
    }

    private RSAPrivateKey loadPrivateKey() {
        ConfigInfo modelSecretKey = configInfoMapper.selectOne(Wrappers.<ConfigInfo>lambdaQuery()
                .eq(ConfigInfo::getCategory, CAT_MODEL_SECRET_KEY)
                .eq(ConfigInfo::getCode, CODE_PRIVATE_KEY)
                .eq(ConfigInfo::getIsValid, 1)
                .last("LIMIT 1"));
        if (modelSecretKey == null) {
            throw new BusinessException(ResponseEnum.MODEL_API_KEY_NOT_FOUND);
        }

        try {
            RSAPrivateKey privateKey = RSAUtil.loadPrivateKey(modelSecretKey.getValue());
            if (privateKey == null) {
                throw new IllegalStateException("Private key is null");
            }
            return privateKey;
        } catch (Exception e) {
            log.error("Load agent memory private key failed", e);
            throw new BusinessException(ResponseEnum.MODEL_APIKEY_LOAD_ERROR);
        }
    }
}

View on GitHub (pinned to 5e758547a8)