larksuite/cli · error

environment variable %q is not allowlisted in provider

Error message

environment variable %q is not allowlisted in provider

What it means

resolveEnvRef resolves a secret reference from an environment variable, but only if that variable name appears in the provider's allowlist (pc.EnvKeys or equivalent). The library throws this error when the referenced variable is not present in the allowlist, even if the variable is actually set, to enforce explicit disclosure of which env vars a provider may read. This prevents accidental leakage of unrelated secrets into secret resolution.

Source

Thrown at internal/binding/secret_resolve.go:95

		return resolveExecRef(ref, providerName, providerConfig, getenv)
	default:
		return "", fmt.Errorf("unsupported secret source %q", ref.Source)
	}
}

// resolveEnvRef handles {source:"env"} SecretRef.
func resolveEnvRef(ref *SecretRef, pc *ProviderConfig, getenv func(string) string) (string, error) {
	// Check allowlist if configured
	if len(pc.Allowlist) > 0 {
		allowed := false
		for _, name := range pc.Allowlist {
			if name == ref.ID {
				allowed = true
				break
			}
		}
		if !allowed {
			return "", fmt.Errorf("environment variable %q is not allowlisted in provider", ref.ID)
		}
	}

	value := getenv(ref.ID)
	if value == "" {
		return "", fmt.Errorf("environment variable %q is missing or empty", ref.ID)
	}
	return value, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Add the environment variable name to the provider's allowlist (the env-keys field in the provider config) using the exact name in ref.ID
2. Fix the SecretRef ID so it matches an already-allowlisted variable name
3. Verify the provider config file you intend is actually being loaded (a stale config may have an outdated allowlist)

Example fix

// before
provider:
  env-keys: ["API_KEY"]
ref: env:DB_PASSWORD

// after
provider:
  env-keys: ["API_KEY", "DB_PASSWORD"]
ref: env:DB_PASSWORD

// before resolving, confirm the ref's env var is allowlisted
func isEnvAllowlisted(providerCfg ProviderConfig, refID string) bool {
    for _, k := range providerCfg.EnvKeys {
        if k == refID {
            return true
        }
    }
    return false
}
if !isEnvAllowlisted(cfg, ref.ID) {
    return fmt.Errorf("env var %q must be added to provider %q allowlist", ref.ID, cfg.Name)
}

val, err := resolveSecretRef(ctx, ref)
if err != nil {
    var notAllowed *NotAllowlistedError
    if errors.As(err, &notAllowed) {
        log.Fatalf("add %q to the provider's env allowlist in config", notAllowed.Var)
    }
    return err
}

When it happens

Trigger: Calling resolveSecretRef with a SecretRef whose ID names an environment variable that is not listed in the provider config's allowlisted env keys; the allowlist loop iterates all names and `allowed` stays false.

Common situations: Typo in the env var name inside the secret ref (e.g. DB_PASS vs DB_PASSWORD); adding a new env var to the environment but forgetting to add it to the provider's allowlist in config; copying a secret ref between providers with different allowlists.

Related errors

• environment variable %q is missing or empty
• env variable %q referenced in openclaw.json is not set or em
• exec provider command is empty
• multiple plugins called Restrict; only one plugin may own th
• appSecret is missing or empty

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/2aa174ab7e087aa3. Report an issue: GitHub.