infiniflow/ragflow · critical · SandboxProviderConfigError

Tenki authentication failed: check the API key.

Error message

Tenki authentication failed: check the API key.

What it means

Raised when client.create() during create_instance() throws errors.UnauthorizedError: the Tenki API rejected the configured api_key. It is mapped to SandboxProviderConfigError (not RuntimeError) because it is a configuration problem, not a transient runtime failure.

Source

Thrown at agent/sandbox/providers/tenki.py:151

            "metadata": {"source": "ragflow"},
        }
        if self.image:
            create_kwargs["image"] = self.image
        if self.cpu_cores > 0:
            create_kwargs["cpu_cores"] = self.cpu_cores
        if self.memory_mb > 0:
            create_kwargs["memory_mb"] = self.memory_mb
        if self.disk_size_gb > 0:
            create_kwargs["disk_size_gb"] = self.disk_size_gb

        try:
            sandbox = self._client.create(**create_kwargs)
        except errors.QuotaExceededError as exc:
            raise RuntimeError(f"Tenki quota exceeded: {exc}") from exc
        except errors.RateLimitedError as exc:
            raise RuntimeError(f"Tenki rate limited, please retry: {exc}") from exc
        except errors.UnauthorizedError as exc:
            raise SandboxProviderConfigError("Tenki authentication failed: check the API key.") from exc
        except Exception as exc:
            # Satisfy the base contract: any other SDK failure becomes RuntimeError.
            raise RuntimeError(f"Failed to create Tenki sandbox: {exc}") from exc

        remote_work_dir = posixpath.join(SANDBOX_HOME, f"ragflow-codeexec-{uuid.uuid4().hex}")
        try:
            result = sandbox.exec(
                "mkdir",
                "-p",
                posixpath.join(remote_work_dir, "artifacts"),
                timeout=min(self.timeout, 10),
            )
            if result.exit_code != 0:
                raise RuntimeError(f"Failed to create sandbox workspace: {result.stderr_text or 'unknown error'}")
        except Exception:
            self._safe_terminate(sandbox)
            raise

View on GitHub (pinned to 554fb1133a)

Solutions

1. Verify the api_key against the Tenki console and update the sandbox provider config.
2. Confirm the key matches the environment of base_url (no staging key against production endpoint, and vice versa).
3. If the key was recently rotated, re-run initialize() with the new key — the cached client holds the old auth_token.

Example fix

# before
provider.initialize({"api_key": "tk_old_revoked_key"})

# after
provider.initialize({"api_key": os.environ["TENKI_API_KEY"]})  # current key from secrets store

from agent.sandbox.providers.base import SandboxProviderConfigError
# fail fast at startup instead of at create time:
provider.initialize({"api_key": key})  # who_am_i() check raises here if key is bad

try:
    instance = provider.create_instance(template)
except SandboxProviderConfigError as exc:
    if "authentication failed" in str(exc):
        alert_key_rotation()  # key is dead; do not retry, reconfigure
    raise

When it happens

Trigger: initialize() with an api_key that is expired, revoked, or copied incorrectly (whitespace handled, but wrong key is not); creation then fails the first authenticated call. Note initialize()'s who_am_i() connectivity check usually catches this earlier — seeing it here means the key became invalid between initialize() and create_instance().

Common situations: Rotated or expired API keys, keys from a different Tenki environment than base_url points at, or a key that lost sandbox permissions.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid Tenki provider configuration.
• Failed to reach Tenki API: {exc}
• UCloud Agent Sandbox authentication failed: check the API ke
• main() must be defined or exported.
• Failed to delete memory

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/424949e4ab9540fd. Report an issue: GitHub.