micro/go-micro · error

no secret key is defined

Error message

no secret key is defined

What it means

The secretbox (NaCl secretbox, symmetric) backend's Init requires a shared secret key. This error is thrown when Init is called (or no options provide a key), leaving options.Key empty. Without a key the backend cannot encrypt or decrypt.

Source

Thrown at config/secrets/secretbox/secretbox.go:35

	secretKey [keyLength]byte
}

// NewSecrets returns a secretbox codec.
func NewSecrets(opts ...secrets.Option) secrets.Secrets {
	sb := &secretBox{}
	for _, o := range opts {
		o(&sb.options)
	}
	return sb
}

func (s *secretBox) Init(opts ...secrets.Option) error {
	for _, o := range opts {
		o(&s.options)
	}
	if len(s.options.Key) == 0 {
		return errors.New("no secret key is defined")
	}
	if len(s.options.Key) != keyLength {
		return errors.Errorf("secret key must be %d bytes long", keyLength)
	}
	copy(s.secretKey[:], s.options.Key)
	return nil
}

func (s *secretBox) Options() secrets.Options {
	return s.options
}

func (s *secretBox) String() string {
	return "nacl-secretbox"
}

func (s *secretBox) Encrypt(in []byte, opts ...secrets.EncryptOption) ([]byte, error) {
	// no opts are expected, so they are ignored

View on GitHub (pinned to 24529f1404)

Solutions

1. Pass the key to Init, e.g. sb.Init(secrets.WithKey(key)) with a 32-byte key.
2. Load the key from your environment/config and check it is non-empty and exactly 32 bytes before Init.
3. Fail fast at startup: if the key is missing, abort boot with a clear operator-facing message.

Example fix

// before
sb.Init()
// after
key := os.Getenv("SECRETBOX_KEY")
if len(key) != 32 {
    log.Fatal("SECRETBOX_KEY must be exactly 32 bytes")
}
sb.Init(secrets.WithKey([]byte(key)))

key := []byte(os.Getenv("SECRETBOX_KEY"))
if len(key) == 0 {
    return errors.New("SECRETBOX_KEY is required")
}

When it happens

Trigger: Calling Init() with no options; passing options that configure other fields but not Key; constructing the secretBox backend without wiring the key from config or environment.

Common situations: Environment variable for the secret not set in the deployment; config file missing the key field; a refactor renamed the option so the old one is silently ignored.

Related errors

• recepient's public key must be provided
• decryption failed (is the key set correctly?)
• agent: ResumeStreamAsk requires a checkpoint
• ai model is nil
• sender's public key bust be provided

AI-assisted analysis of micro/go-micro@24529f1404 (2026-09-01). Data as JSON: /api/errors/67b1955855381b38. Report an issue: GitHub.