langgenius/dify · critical · ValueError

SECRET_KEY is not set and could not be generated at {GENERAT

Error message

SECRET_KEY is not set and could not be generated at {GENERATED_SECRET_KEY_FILENAME}. Set SECRET_KEY explicitly or make storage writable.

What it means

Raised by _load_or_create_secret_key when SECRET_KEY is unset and storage.save('.dify_secret_key') fails. The app tries to persist a freshly generated key so sessions stay stable across restarts; if the storage backend is read-only or misconfigured, generation is refused to avoid rotating the key on every boot (which would invalidate sessions).

Source

Thrown at api/configs/secret_key.py:33

        return secret_key

    return _load_or_create_secret_key()


def _load_or_create_secret_key() -> str:
    try:
        persisted_key = storage.load_once(GENERATED_SECRET_KEY_FILENAME).decode("utf-8").strip()
        if persisted_key:
            return persisted_key
    except FileNotFoundError:
        pass

    generated_key = secrets.token_urlsafe(48)

    try:
        storage.save(GENERATED_SECRET_KEY_FILENAME, f"{generated_key}\n".encode())
    except Exception as exc:
        raise ValueError(
            f"SECRET_KEY is not set and could not be generated at {GENERATED_SECRET_KEY_FILENAME}. "
            "Set SECRET_KEY explicitly or make storage writable."
        ) from exc

    return generated_key

View on GitHub (pinned to ef8544b173)

Solutions

1. Set SECRET_KEY explicitly in the environment (recommended for production).
2. If using generated keys, make the storage path writable (mount a writable volume).
3. For S3-type storage, verify STORAGE_S3_BUCKET/credentials/region so save() succeeds.
4. Run the container with a writable volume for the storage root.

Example fix

// before
SECRET_KEY=
// (read-only fs)
// after
SECRET_KEY=<a stable random string of >=32 chars>
// OR ensure /app/storage is a writable volume

import os

def secret_key_ok(secret_key: str, storage_writable: bool) -> bool:
    return bool(secret_key) or storage_writable

When it happens

Trigger: SECRET_KEY empty and the configured storage (local fs / S3-compatible) cannot write .dify_secret_key — e.g. read-only mount, missing credentials, or wrong bucket.

Common situations: Container filesystem mounted read-only, STORAGE_TYPE set to s3 but STORAGE_S3_* credentials wrong, or volume permission denied.

Related errors

• KNOWLEDGE_FS_BASE_URL must not include credentials, query, o
• ELASTICSEARCH_API_KEY is required when using Elastic Cloud
• ELASTICSEARCH_USERNAME is required for self-hosted Elasticse
• ELASTICSEARCH_PASSWORD is required for self-hosted Elasticse
• bad YAML format

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/1bfff7171fee7418. Report an issue: GitHub.