What causes "auth_tokens: 'keys' not found for cookie auth token" in kgretzky/evilginx2?

Add a `keys` list of cookie names to the cookie auth token entry (e.g. `keys: [auth_session, auth_token]`).

auth_tokens: 'keys' not found for cookie auth token

Error message

auth_tokens: 'keys' not found for cookie auth token

What it means

This error is thrown when a `cookie`-type entry in a phishlet's `auth_tokens` section defines a `domain` but omits the required `keys` field, the list of cookie names to capture as auth tokens. Without keys there is nothing to identify, so the entry is invalid and the phishlet fails to load.

Source

Thrown at core/phishlet.go:535

				return err
			}
		}
	}
	for _, at := range *fp.AuthTokens {
		ttype := "cookie"
		if at.Type != nil {
			ttype = *at.Type
		}
		if !stringExists(ttype, AUTH_TOKEN_TYPES) {
			return fmt.Errorf("auth_tokens: invalid token type: %s", ttype)
		}
		switch ttype {
		case "cookie":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for cookie auth token")
			}
			if at.Keys == nil {
				return fmt.Errorf("auth_tokens: 'keys' not found for cookie auth token")
			}

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a `keys` list of cookie names to the cookie auth token entry (e.g. `keys: [auth_session, auth_token]`).
If no cookie names are known yet, remove or comment out the entry until they are identified from the target's login flow.
Confirm `keys` is a YAML list at the same indentation as `domain` within the same entry.

Example fix

// before (phishlet.yml)
auth_tokens:
  - domain: accounts
// after
auth_tokens:
  - domain: accounts
    keys:
      - auth_session
      - auth_token

Defensive patterns

Strategy: validation

Validate before calling

for i, at := range cfg.AuthTokens {
    if at.Type != nil && *at.Type == "cookie" && at.Keys == nil {
        return fmt.Errorf("auth_tokens[%d]: 'keys' not found for cookie auth token", i)
    }
}

Type guard

func hasCookieKeys(at AuthToken) bool {
    return at.Keys != nil && len(*at.Keys) > 0
}

Prevention

Never submit an auth_tokens entry without its `keys` list.
Identify cookie names from the target's login flow before writing the entry.
Remove stub entries you cannot complete instead of leaving partial config.

When it happens

Trigger: An auth_tokens entry with type cookie declares `domain: accounts` but has no `keys:` list.

Common situations: Incomplete entry after removing a keys list; editing keys out and leaving the entry stub; YAML indentation putting `keys` outside the list item.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c0eba6df176ba0ff. Report an issue: GitHub.