What causes "auth_tokens: 'keys' not found for cookie auth token" in kgretzky/evilginx2?

Add a `keys` list of cookie names to the cookie auth token entry (e.g. `keys: [auth_session, auth_token]`).

auth_tokens: 'keys' not found for cookie auth token

Error message

auth_tokens: 'keys' not found for cookie auth token

What it means

This error is thrown when a `cookie`-type entry in a phishlet's `auth_tokens` section defines a `domain` but omits the required `keys` field, the list of cookie names to capture as auth tokens. Without keys there is nothing to identify, so the entry is invalid and the phishlet fails to load.

Solutions

Add a `keys` list of cookie names to the cookie auth token entry (e.g. `keys: [auth_session, auth_token]`).
If no cookie names are known yet, remove or comment out the entry until they are identified from the target's login flow.
Confirm `keys` is a YAML list at the same indentation as `domain` within the same entry.

Example fix

// before (phishlet.yml)
auth_tokens:
  - domain: accounts
// after
auth_tokens:
  - domain: accounts
    keys:
      - auth_session
      - auth_token

Defensive patterns

Strategy: validation

Validate before calling

for i, at := range cfg.AuthTokens {
    if at.Type != nil && *at.Type == "cookie" && at.Keys == nil {
        return fmt.Errorf("auth_tokens[%d]: 'keys' not found for cookie auth token", i)
    }
}

Type guard

func hasCookieKeys(at AuthToken) bool {
    return at.Keys != nil && len(*at.Keys) > 0
}

Prevention

Never submit an auth_tokens entry without its `keys` list.
Identify cookie names from the target's login flow before writing the entry.
Remove stub entries you cannot complete instead of leaving partial config.

When it happens

Trigger: An auth_tokens entry with type cookie declares `domain: accounts` but has no `keys:` list.

Common situations: Incomplete entry after removing a keys list; editing keys out and leaving the entry stub; YAML indentation putting `keys` outside the list item.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c0eba6df176ba0ff. Report an issue: GitHub.

Appendix: source

Thrown at core/phishlet.go:535

				return err
			}
		}
	}
	for _, at := range *fp.AuthTokens {
		ttype := "cookie"
		if at.Type != nil {
			ttype = *at.Type
		}
		if !stringExists(ttype, AUTH_TOKEN_TYPES) {
			return fmt.Errorf("auth_tokens: invalid token type: %s", ttype)
		}
		switch ttype {
		case "cookie":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for cookie auth token")
			}
			if at.Keys == nil {
				return fmt.Errorf("auth_tokens: 'keys' not found for cookie auth token")
			}

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")

View on GitHub (pinned to 4c0988a1d9)