tenant bootstrap API key is already assigned to another…

Error message

tenant bootstrap API key is already assigned to another active app

What it means

findTenantBootstrapCredential checks whether the desired bootstrap API key is owned by a different, non-deleted app (SELECT ... WHERE api_key = ? AND app_id <> ? AND is_delete = 0 FOR UPDATE). If such a row exists, the key is already taken by another active app and assigning it to the bootstrap app would collide, so reconciliation aborts.

Solutions

Change the configured bootstrap API key to a unique value not present in tb_app
Soft-delete or re-key the app currently owning the conflicting api_key
Audit tb_app for duplicate api_key values and enforce uniqueness
Re-run bootstrap reconciliation after the collision is removed

Example fix

// before
TenantBootstrap: {APIKey: "ak-duplicate"} // also owned by app X
// after
TenantBootstrap: {APIKey: "ak-fresh-unique-value"}

Defensive patterns

Strategy: validation

Validate before calling

var n int
_ = db.QueryRow(`SELECT COUNT(*) FROM tb_app WHERE api_key = ? AND app_id <> ? AND is_delete = 0`, apiKey, tenantID).Scan(&n)
if n > 0 { return errors.New("bootstrap api_key already in use by another active app") }

Prevention

Generate bootstrap API keys from a dedicated reserved namespace
Add a unique index on api_key for active (is_delete=0) rows
Audit for duplicated keys after environment imports

When it happens

Trigger: reconcileTenantBootstrapTransaction runs while another app in tb_app holds the same api_key with is_delete=0; typically after the bootstrap api_key value was copied or reused for a different app.

Common situations: Manually duplicated API key across apps, another environment's seed data imported into this DB, or bootstrap credential config pointing at a key already issued to a regular app.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/15b0e8e86bcd7bac. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/tools/database/bootstrap_credentials.go:175

}

func findTenantBootstrapCredential(
	ctx context.Context,
	transaction bootstrapTransaction,
	credentials config.TenantBootstrapCredentials,
) (bool, error) {
	var collisionOwner string
	err := transaction.QueryRowContext(
		ctx,
		`SELECT app_id
FROM tb_auth
WHERE api_key = ? AND app_id <> ? AND is_delete = 0
LIMIT 1 FOR UPDATE`,
		credentials.APIKey,
		credentials.TenantID,
	).Scan(&collisionOwner)
	if err == nil {
		return false, errors.New("tenant bootstrap API key is already assigned to another active app")
	}
	if !errors.Is(err, sql.ErrNoRows) {
		return false, fmt.Errorf("check tenant bootstrap API key ownership failed: %w", err)
	}

	var unmanagedSecret sql.NullString
	var unmanagedIsDelete sql.NullBool
	err = transaction.QueryRowContext(
		ctx,
		`SELECT api_secret, is_delete
	FROM tb_auth
	WHERE app_id = ? AND api_key = ? AND COALESCE(extend, '') <> ?
	LIMIT 1 FOR UPDATE`,
		credentials.TenantID,
		credentials.APIKey,
		tenantBootstrapManagedMarker,
	).Scan(&unmanagedSecret, &unmanagedIsDelete)
	if err == nil {

View on GitHub (pinned to 5e758547a8)