iflytek/astron-agent · error · BusinessException

MODEL_APIKEY_LOAD_ERROR

MODEL_APIKEY_LOAD_ERROR

Error message

ResponseEnum.MODEL_APIKEY_LOAD_ERROR

What it means

AgentMemorySecretService.decryptApiKey wraps RSA decryption of the stored agent-memory API key. Any failure (bad ciphertext, wrong key, malformed Base64) is converted to MODEL_APIKEY_LOAD_ERROR after logging. It means the stored ciphertext could not be decrypted with the configured private key.

Solutions

  1. Re-encrypt the API key with the public key matching the current configured private key and save it again via saveConfig.
  2. Verify config_info (category=model secret key, code=private key) holds the correct, unmodified private key.
  3. Check the ciphertext is complete, valid Base64, and not truncated by the DB column size.

Example fix

// before
String ct = encryptWithOldPublicKey(rawKey); // key since rotated
config.setApiKeyCiphertext(ct);
// after
String ct = RSAUtil.encryptByPublicKey(rawKey, currentPublicKey);
config.setApiKeyCiphertext(ct); // decryptable with current private key
Defensive patterns

Strategy: try-catch

Validate before calling

// ciphertext sanity check before sending
if (!/^[A-Za-z0-9+/=\r\n]+$/.test(ciphertext)) { throw new Error('not valid base64 ciphertext'); }

Try / catch

try { String key = secretService.decryptApiKey(ct); } catch (BusinessException e) { if (e.getCode() == ResponseEnum.MODEL_APIKEY_LOAD_ERROR) { markKeyAsNeedsReentry(); } }

Prevention

When it happens

Trigger: Calling any flow that decrypts the memory API key when the stored apiKeyCiphertext is corrupt, was encrypted with a different/wrong public key, is truncated, or is not valid Base64.

Common situations: RSA keypair rotated in config_info so old ciphertexts no longer decrypt; ciphertext copy-pasted with whitespace/newlines; data migrated between environments with different private keys.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/389fc03f51f8ebdf. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/agentmemory/runtime/AgentMemorySecretService.java:35

@RequiredArgsConstructor
public class AgentMemorySecretService {

    private static final String CAT_MODEL_SECRET_KEY = "MODEL_SECRET_KEY";
    private static final String CODE_PRIVATE_KEY = "private_key";
    private static final long PRIVATE_KEY_CACHE_TTL_MS = 60_000L;

    private final ConfigInfoMapper configInfoMapper;

    private volatile RSAPrivateKey cachedPrivateKey;
    private volatile long privateKeyCacheExpiresAt;

    public String decryptApiKey(String apiKeyCiphertext) {
        RSAPrivateKey privateKey = getPrivateKey();
        try {
            return RSAUtil.decryptByPrivateKeyBase64(apiKeyCiphertext, privateKey);
        } catch (Exception e) {
            log.error("Decrypt agent memory API key failed", e);
            throw new BusinessException(ResponseEnum.MODEL_APIKEY_LOAD_ERROR);
        }
    }

    private RSAPrivateKey getPrivateKey() {
        long now = System.currentTimeMillis();
        RSAPrivateKey privateKey = cachedPrivateKey;
        if (privateKey != null && now < privateKeyCacheExpiresAt) {
            return privateKey;
        }
        synchronized (this) {
            now = System.currentTimeMillis();
            privateKey = cachedPrivateKey;
            if (privateKey != null && now < privateKeyCacheExpiresAt) {
                return privateKey;
            }
            privateKey = loadPrivateKey();
            cachedPrivateKey = privateKey;
            privateKeyCacheExpiresAt = System.currentTimeMillis() + PRIVATE_KEY_CACHE_TTL_MS;

View on GitHub (pinned to 5e758547a8)