What causes "api key is not set" in kgretzky/evilginx2?

Set the API key (SetApiKey / config gophish api_key) from the GoPhish Users page

api key is not set

Error message

api key is not set

What it means

validateSetup is a generic pre-flight validation guard: the GoPhish integration cannot be used because o.ApiKey is the empty string (no API key was configured). It fires before any request is attempted, via Test and the reporting callbacks.

Source

Thrown at core/gophish.go:155

	if err != nil {
		return err
	}
	switch resp.StatusCode() {
	case 200:
		return nil
	case 401:
		return fmt.Errorf("invalid api key")
	default:
		return fmt.Errorf("status: %d", resp.StatusCode())
	}
}

func (o *GoPhish) validateSetup() error {
	if o.AdminUrl == nil {
		return fmt.Errorf("admin url is not set")
	}
	if o.ApiKey == "" {
		return fmt.Errorf("api key is not set")
	}
	return nil
}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Set the API key (SetApiKey / config gophish api_key) from the GoPhish Users page
Persist the key in config so it loads on startup
Re-run GoPhish Test to confirm the setup is complete

Example fix

// before
goPhish.SetAdminUrl(adminUrl)
goPhish.Test()
// after
goPhish.SetAdminUrl(adminUrl)
goPhish.SetApiKey(apiKey)
goPhish.Test()

Defensive patterns

Strategy: validation

Validate before calling

if gp.ApiKey == "" {
    return errors.New("configure gophish api key first")
}

Try / catch

if err := gp.ReportEmailOpened(id, email); err != nil {
    if err.Error() == "api key is not set" {
        // complete setup: SetApiKey then retry
    }
}

Prevention

Set both AdminUrl and ApiKey together during setup
Never save the key as an empty string
Call Test() once at startup to validate the pair

When it happens

Trigger: Calling Test, ReportEmailOpened, ReportEmailLinkClicked, or ReportCredentialsSubmitted without having set the API key via the corresponding setter / config entry.

Common situations: Admin URL set but key step skipped during setup; config loaded from a template lacking the api_key field; key accidentally cleared or saved as empty string.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/373aee8177c4cdbf. Report an issue: GitHub.