What causes "plugin store auth env %s is empty" in router-for-me/CLIProxyAPI?

Export the variable in the environment that actually runs the process (systemd Environment=, docker -e, .env beside config.yaml)

router-for-me/CLIProxyAPI · error

plugin store auth env %s is empty

Error message

plugin store auth env %s is empty

What it means

The env var named by an auth rule's *-env field is unset or contains only whitespace in the process environment (envValueRequired trims the value). The rule is structurally valid but the secret itself is missing at resolution time, so the store cannot build the Authorization header. Distinct from error 594, which fires when the env var *name* is missing.

Source

Thrown at internal/pluginstore/auth.go:468

	if len(item.ApplyTo) == 0 {
		return true
	}
	for _, value := range item.ApplyTo {
		if strings.EqualFold(strings.TrimSpace(value), kind) {
			return true
		}
	}
	return false
}

func envValueRequired(envName string, field string) (string, error) {
	envName = strings.TrimSpace(envName)
	if envName == "" {
		return "", fmt.Errorf("plugin store auth missing %s", field)
	}
	value := strings.TrimSpace(os.Getenv(envName))
	if value == "" {
		return "", fmt.Errorf("plugin store auth env %s is empty", envName)
	}
	return value, nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

Export the variable in the environment that actually runs the process (systemd Environment=, docker -e, .env beside config.yaml)
Check the variable name in config matches exactly (case-sensitive) what is set
Restart the service after adding the variable
For k8s/containers, verify the secret is mounted into env, not just a file

Example fix

# before (systemd unit)
[Service]
Environment=PLUGIN_TOKEN=

# after
[Service]
Environment=PLUGIN_TOKEN=actual-token

Defensive patterns

Strategy: validation

Validate before calling

func allAuthEnvsSet(rules []AuthConfig) error {
    for _, r := range rules {
        for _, name := range []string{r.TokenEnv, r.UsernameEnv, r.PasswordEnv, r.HeaderValueEnv} {
            if strings.TrimSpace(name) != "" && strings.TrimSpace(os.Getenv(name)) == "" {
                return fmt.Errorf("required env %s is not set", name)
            }
        }
    }
    return nil
}

Prevention

Preflight all required env vars at process start and fail loudly
Keep .env next to config.yaml and run the service from that directory so auto-load applies
In containers, inject secrets via the orchestrator's secret mechanism, not baked images

When it happens

Trigger: token-env: PLUGIN_TOKEN is configured, but PLUGIN_TOKEN is not set in the environment of the running CLIProxyAPI process when a matching store request resolves auth.

Common situations: Var set in the developer shell but not in the systemd unit/Docker container/k8s deployment; .env not loaded because the service runs from a different working directory; typo in the variable name; secret removed during rotation.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/d7d0aac1a2729f52. Report an issue: GitHub.