What causes "invalid api key" in kgretzky/evilginx2?

Regenerate/copy the API key from GoPhish (Users page) and update the integration config

invalid api key

Error message

invalid api key

What it means

apiRequest received HTTP 401 from the GoPhish admin API, meaning the configured ApiKey was rejected as an authentication credential. It fires after a successful request round-trip; the request itself is fine, the key is wrong, revoked, or lacks permission.

Source

Thrown at core/gophish.go:144

	req := cl.R().
		SetHeader("Content-Type", "application/json").
		SetAuthToken(o.ApiKey)

	if content != nil {
		resp, err = req.SetBody(content).Post(reqUrl)
	} else {
		resp, err = req.Get(reqUrl)
	}

	if err != nil {
		return err
	}
	switch resp.StatusCode() {
	case 200:
		return nil
	case 401:
		return fmt.Errorf("invalid api key")
	default:
		return fmt.Errorf("status: %d", resp.StatusCode())
	}
}

func (o *GoPhish) validateSetup() error {
	if o.AdminUrl == nil {
		return fmt.Errorf("admin url is not set")
	}
	if o.ApiKey == "" {
		return fmt.Errorf("api key is not set")
	}
	return nil
}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Regenerate/copy the API key from GoPhish (Users page) and update the integration config
Verify AdminUrl points to the same GoPhish instance that issued the key
Trim whitespace/quotes from the stored key
Run the GoPhish Test method after fixing to confirm 200 responses

Example fix

// before
o.SetApiKey("  old-key  ")
// after
o.SetApiKey(strings.TrimSpace(newKeyFromGoPhish))

Defensive patterns

Strategy: try-catch

Validate before calling

// check before calling
if gophish.ApiKey == "" { return errors.New("api key not configured") }

Try / catch

if err := gp.ReportEmailOpened(campaignID, email); err != nil {
    if err.Error() == "invalid api key" {
        // prompt for a new API key and retry once
    }
}

Prevention

Re-copy the key after any GoPhish key rotation
Trim whitespace/quotes from pasted keys
Ensure AdminUrl and key belong to the same instance
Periodically call GoPhish Test as a health check

When it happens

Trigger: Calling GoPhish Test, ReportEmailOpened, ReportEmailLinkClicked, or ReportCredentialsSubmitted when o.ApiKey is wrong, revoked, or belongs to a different GoPhish instance than o.AdminUrl.

Common situations: Rotating the API key in GoPhish UI without updating evilginx config; copying the key from a staging GoPhish while pointing at production; whitespace/quotes around the pasted key.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c0f7a70258f5abde. Report an issue: GitHub.