langgenius/dify · error · Unauthorized
API key is invalid.
Error message
API key is invalid.
What it means
werkzeug Unauthorized (HTTP 401) from the admin_required guard: dify_config.ADMIN_API_KEY is falsy (unset/empty), so the entire admin API surface is disabled. No admin request can be authorized until the operator configures the key. The same message is reused at line 21 for a wrong-key mismatch, but this path is specifically the 'admin API not configured' branch.
Source
Thrown at api/controllers/console/admin.py:15
from collections.abc import Callable
from functools import wraps
from flask import request
from werkzeug.exceptions import Unauthorized
from configs import dify_config
from libs.token import extract_access_token
def admin_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:
@wraps(view)
def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
if not dify_config.ADMIN_API_KEY:
raise Unauthorized("API key is invalid.")
auth_token = extract_access_token(request)
if not auth_token:
raise Unauthorized("Authorization header is missing.")
if auth_token != dify_config.ADMIN_API_KEY:
raise Unauthorized("API key is invalid.")
return view(*args, **kwargs)
return decorated
View on GitHub (pinned to ef8544b173)
Solutions
- Set ADMIN_API_KEY to a strong secret in the API process environment (docker/.env for compose, helm values for k8s) and restart the API service.
- Confirm the value is loaded: dify_config.ADMIN_API_KEY should be non-empty after startup.
- If you intentionally disabled admin access, remove or stop calling the admin endpoint rather than leaving it half-configured.
- Rotate and re-inject the key from your secret manager if it was wiped by a config sync.
Example fix
# before (docker/.env) # ADMIN_API_KEY= # after ADMIN_API_KEY=<strong-random-secret>
Defensive patterns
Strategy: validation
Validate before calling
from configs import dify_config
def admin_api_enabled() -> bool:
return bool(getattr(dify_config, 'ADMIN_API_KEY', '') and dify_config.ADMIN_API_KEY.strip()) Prevention
- Provision ADMIN_API_KEY in every environment that runs admin routes (compose env, helm values, CI).
- Fail deployment startup if ADMIN_API_KEY is empty when admin routes are enabled.
- Keep the key in a secret manager and verify injection on deploy.
When it happens
Trigger: Calling any endpoint behind @admin_required (console admin routes) when the ADMIN_API_KEY environment/config value is not set. The first such request always fails until an operator sets the key.
Common situations: Fresh deployment without ADMIN_API_KEY populated in docker/.env or the API process env; config reload that reset the key to empty; secret manager outage that failed to inject ADMIN_API_KEY; CI environment that exercises an admin route without provisioning the key.
Related errors
AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12).
Data as JSON: /api/errors/62ac1c17f0b5a293.
Report an issue: GitHub.