juspay/hyperswitch · error · ApiErrorResponse

Ilixium requires SignatureKey auth type

Error message

Ilixium requires SignatureKey auth type

What it means

Thrown in ConnectorSpecificConfig::foreign_try_from while building the X_CONNECTOR_CONFIG header for the Ilixium connector (reached via build_connector_config_header, connector_config.rs:1876). The match on ConnectorAuthType only has an Ok arm for SignatureKey { api_key, key1, api_secret }; every other variant (HeaderKey, BodyKey, MultiAuthKey, CurrencyAuthKey, CertificateAuth, TemporaryAuth, NoKey) falls into the wildcard arm and returns this error. It means the stored merchant connector auth shape does not match what Ilixium's config requires.

Source

Thrown at crates/router/src/core/unified_connector_service/connector_config.rs:1259

                    api_secret,
                } => Ok(Self::Tesouro {
                    api_key: api_key.clone(),
                    key1: key1.clone(),
                    api_secret: api_secret.clone(),
                }),
                _ => Err(err("Tesouro requires SignatureKey auth type")),
            },
            Connector::Ilixium => match auth {
                ConnectorAuthType::SignatureKey {
                    api_key,
                    key1,
                    api_secret,
                } => Ok(Self::Ilixium {
                    api_key: api_key.clone(),
                    key1: key1.clone(),
                    api_secret: api_secret.clone(),
                }),
                _ => Err(err("Ilixium requires SignatureKey auth type")),
            },
            Connector::Checkout => match auth {
                ConnectorAuthType::SignatureKey {
                    api_key,
                    key1,
                    api_secret,
                } => Ok(Self::Checkout {
                    api_key: api_key.clone(),
                    api_secret: api_secret.clone(),
                    processing_channel_id: key1.clone(),
                }),
                _ => Err(err("Checkout requires SignatureKey auth type")),
            },
            Connector::Dlocal => match auth {
                ConnectorAuthType::SignatureKey {
                    api_key,
                    key1,
                    api_secret,

View on GitHub (pinned to 3093f22cc4)

Solutions

1. Update the Ilixium connector account to auth_type = SignatureKey with all three fields: api_key, key1, and api_secret (all map 1:1 into ConnectorSpecificConfig::Ilixium).
2. If the create/update payload omitted auth_type, add the full SignatureKey object — ConnectorAuthType defaults to NoKey, which always lands in the wildcard arm.
3. Verify no secrets were dropped as empty strings by the form layer; the variant needs all three Secret fields present in the JSON.
4. As a maintainer, consider validating auth_type per connector at account-create time so the error surfaces at write, not at payment time.

Example fix

// before — connector account auth for Ilixium
"auth_type": { "auth_type": "HeaderKey", "api_key": "pk_ilx" }

// after
"auth_type": {
  "auth_type": "SignatureKey",
  "api_key": "pk_ilx",
  "key1": "<ilixium key1>",
  "api_secret": "<ilixium api_secret>"
}

// Before creating/updating an Ilixium connector account
let auth_ok = matches!(
    &payload.auth_type,
    ConnectorAuthType::SignatureKey { api_key, key1, api_secret }
        if !api_key.is_empty() && !key1.is_empty() && !api_secret.is_empty()
);
assert!(auth_ok, "Ilixium requires SignatureKey with api_key, key1, api_secret");

fn is_ilixium_compatible(auth: &ConnectorAuthType) -> bool {
    matches!(auth, ConnectorAuthType::SignatureKey { .. })
}

// Rust: fail at account-create time; at payment time convert to a 4xx config error
match build_connector_config_header(Connector::Ilixium, &auth, metadata) {
    Ok(h) => h,
    Err(e) if e.current_context().message.contains("Ilixium requires") => {
        return Err(ReportConfigError { connector: "ilixium", expected_auth: "SignatureKey", source: e })
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: A merchant connector account for connector_name = "ilixium" is created (POST/PUT /account/connectors) with auth_type other than SignatureKey — e.g. HeaderKey with only api_key — and a later payment/UCS call invokes build_connector_config_header, or the account creation itself routes through the UCS conversion. It also fires when auth deserializes to the default variant NoKey because auth_type was omitted from the payload.

Common situations: Copy-pasting another connector's auth block (e.g. Stripe-style single api_key with HeaderKey) into an Ilixium account; a dashboard that only exposes api_key/key1 but silently drops api_secret, causing serde to fall back or the caller to pick HeaderKey; migrating accounts from the legacy auth header path to the unified connector service where the SignatureKey requirement is newly enforced; NoKey default leaking in when auth is optional in a create form.

Related errors

• Iatapay requires SignatureKey auth type
• Moneris requires SignatureKey auth type
• Invalid Calida metadata format
• Worldpayxml requires SignatureKey auth type

AI-assisted analysis of juspay/hyperswitch@3093f22cc4 (2026-08-23). Data as JSON: /api/errors/d35c8bc91ce5d940. Report an issue: GitHub.