What causes "Could not validate Yubikey configuration." in passbolt/passbolt_api?

Check the errors payload in the exception for the exact failing field (MfaOrgSettings::PROVIDER_YUBIKEY -> clientId/secretKey).

passbolt/passbolt_api · error · CustomValidationException

Could not validate Yubikey configuration.

Error message

Could not validate Yubikey configuration.

What it means

Thrown by validateYubikeySettings when the organization-level MFA Yubikey settings fail validation. It collects per-field validation errors into a CustomValidationException so the API client can see exactly which fields (e.g. clientId, secretKey) are wrong.

Solutions

Check the errors payload in the exception for the exact failing field (MfaOrgSettings::PROVIDER_YUBIKEY -> clientId/secretKey).
Ensure the Yubikey client id is a valid integer and the secret key is the correct value from the Yubico API dashboard.
Trim whitespace/quotes when pasting credentials into the settings JSON/form.
Retry saving the organization settings after correcting the fields.

Example fix

// before
{"providers": {"yubikey": {"clientId": "", "secretKey": "abc"}}}
// after
{"providers": {"yubikey": {"clientId": "12345", "secretKey": "correct-secret-from-yubico"}}}

Defensive patterns

Strategy: validation

Validate before calling

if (!is_numeric($data['yubikey']['clientId']) || empty($data['yubikey']['secretKey'])) { // reject before POST }

Try / catch

try { $api->saveMfaOrgSettings($payload); } catch (CustomValidationException $e) { $errors = $e->getErrors(); }

Prevention

Copy client id/secret exactly from the Yubico dashboard, trimmed of whitespace.
Validate client id is an integer before submission.
Test Yubikey credentials against the Yubico verification API before saving.

When it happens

Trigger: An administrator POSTs MFA organization settings with a Yubikey client id or secret key that fails the form validation rules (empty, wrong format, or non-numeric client id).

Common situations: Admins copy-pasting the Yubikey client secret with extra whitespace, swapping the client id and secret key fields, or leaving one of the two fields blank in the MFA policy settings form.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1f30abea7fa7175a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php:90

                $msg = __('Yubikey OTP clientId should be an integer.');
                $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID]['isValidClientId'] = $msg;
            }
        }

        if (!isset($data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {
            $msg = __('No configuration set for Yubikey OTP secret key.');
            $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY]['notEmpty'] = $msg;
        } else {
            $secretKey = $data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];
            if (!Validation::custom($secretKey, '/^[a-zA-Z0-9\/=\+]{10,128}$/')) {
                $msg = __('Yubikey OTP secret key is not valid.');
                $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY]['isValidSecretKey'] = $msg;
            }
        }

        if (count($errors) !== 0) {
            $msg = __('Could not validate Yubikey configuration.');
            throw new CustomValidationException($msg, $errors);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)