langgenius/dify · error · ApiKeyAuthFailedError

auth_failed

auth_failed

Error message

{message}

What it means

Raised as ApiKeyAuthFailedError (code 'auth_failed') by POST /api-key-auth/data-source/binding when ApiKeyAuthService.create_provider_auth throws any exception. The original exception message is forwarded as the error message. This is the catch-all for upstream provider authentication failures when binding a data-source API key.

Source

Thrown at api/controllers/console/auth/data_source_bearer_auth.py:99

@console_ns.route("/api-key-auth/data-source/binding")
class ApiKeyAuthDataSourceBinding(Resource):
    @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
    @setup_required
    @login_required
    @account_initialization_required
    @is_admin_or_owner_required
    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_CREATE, resource_required=False)
    @console_ns.expect(console_ns.models[ApiKeyAuthBindingPayload.__name__])
    @with_current_tenant_id
    @model_validate(ApiKeyAuthBindingPayload)
    def post(self, req_data: ApiKeyAuthBindingPayload, current_tenant_id: str):
        # The role of the current user in the table must be admin or owner
        data = req_data.model_dump()
        ApiKeyAuthService.validate_api_key_auth_args(data)
        try:
            ApiKeyAuthService.create_provider_auth(current_tenant_id, data, session=db.session())
        except Exception as e:
            raise ApiKeyAuthFailedError(str(e))
        return {"result": "success"}, 200


@console_ns.route("/api-key-auth/data-source/<uuid:binding_id>")
class ApiKeyAuthDataSourceBindingDelete(Resource):
    @setup_required
    @login_required
    @account_initialization_required
    @is_admin_or_owner_required
    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
    @console_ns.response(204, "Binding deleted successfully")
    @with_current_tenant_id
    def delete(self, current_tenant_id: str, binding_id: UUID):
        # The role of the current user in the table must be admin or owner
        ApiKeyAuthService.delete_provider_auth(current_tenant_id, str(binding_id), session=db.session())

        return "", 204

View on GitHub (pinned to ef8544b173)

Solutions

  1. Inspect the wrapped message returned in the error to identify the upstream cause (it is forwarded verbatim).
  2. Re-enter the API key for the provider and confirm it is valid by testing it directly against the provider.
  3. Check network/SSRF proxy connectivity to the provider's authentication endpoint.
  4. Confirm all provider-specific required fields are present in the payload (after validate_api_key_auth_args).
Defensive patterns

Strategy: try-catch

Try / catch

try {
  await post('/api-key-auth/data-source/binding', payload);
} catch (e) {
  if (e.code === 'auth_failed') {
    // surface e.message (upstream cause) to the user; offer to re-enter the key
  } else { throw e; }
}

Prevention

When it happens

Trigger: POST /console/api/api-key-auth/data-source/binding where validate_api_key_auth_args passes but create_provider_auth fails — e.g. the external provider rejected the API key, network/SSRF error reaching the provider, or the provider credentials are malformed at the upstream layer.

Common situations: Wrong/expired/revoked upstream API key; provider endpoint changed or is unreachable; rate limited by the upstream provider; missing required fields for the specific provider; SSRF proxy blocks the provider's auth URL.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/e4a9d9a5e77187f3. Report an issue: GitHub.