ruvnet/ruflo · error · CredentialGeneratorError

INVALID_API_KEY_LENGTH

INVALID_API_KEY_LENGTH

Error message

API key length must be at least 32 characters

What it means

Same constructor-time validation as the password floor, but for key length: apiKeyLength < 32 throws CredentialGeneratorError INVALID_API_KEY_LENGTH. API keys face higher guessing/offline-attack exposure than human passwords, hence the larger floor.

Source

Thrown at v3/@claude-flow/security/src/credential-generator.ts:132

      apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,
    };

    this.validateConfig();
  }

  /**
   * Validates configuration parameters.
   */
  private validateConfig(): void {
    if (this.config.passwordLength < 16) {
      throw new CredentialGeneratorError(
        'Password length must be at least 16 characters',
        'INVALID_PASSWORD_LENGTH'
      );
    }

    if (this.config.apiKeyLength < 32) {
      throw new CredentialGeneratorError(
        'API key length must be at least 32 characters',
        'INVALID_API_KEY_LENGTH'
      );
    }

    if (this.config.secretLength < 32) {
      throw new CredentialGeneratorError(
        'Secret length must be at least 32 characters',
        'INVALID_SECRET_LENGTH'
      );
    }
  }

  /**
   * Generates a cryptographically secure random string using rejection sampling
   * to eliminate modulo bias.
   *
   * @param length - Length of the string to generate

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Set apiKeyLength >= 32 (48+ typical for URL-safe keys)
2. Widen the storage column instead of shrinking the key — fix the constraint, not the entropy
3. Validate the numeric before construction so the error surfaces at config-load time with context

Example fix

// before
new CredentialGenerator({ apiKeyLength: 20 });

// after
new CredentialGenerator({ apiKeyLength: 48 });

const MIN_API_KEY = 32;
if (cfg.apiKeyLength !== undefined && cfg.apiKeyLength < MIN_API_KEY) {
  throw new Error(`apiKeyLength must be >= ${MIN_API_KEY}, got ${cfg.apiKeyLength}`);
}
new CredentialGenerator(cfg);

function isCredentialGeneratorError(e: unknown, code?: string): boolean {
  return e instanceof Error && e.name === 'CredentialGeneratorError'
    && (code === undefined || (e as { code?: string }).code === code);
}

try {
  return new CredentialGenerator(cfg);
} catch (e) {
  if (isCredentialGeneratorError(e, 'INVALID_API_KEY_LENGTH')) {
    return new CredentialGenerator({ ...cfg, apiKeyLength: 32 });
  }
  throw e;
}

When it happens

Trigger: new CredentialGenerator({ apiKeyLength: 20 }); copying a length from password settings into the apiKey field; truncating key length to fit a legacy VARCHAR column.

Common situations: Configs written against older docs with lower floors; DB schema constraints driving the key length down; env var for key length shared with a shorter-password setting.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• INVALID_PASSWORD_LENGTH
• INVALID_SECRET_LENGTH
• INVALID_ROUNDS
• INVALID_MIN_LENGTH
• Invalid completion type

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/167739e89fb108e8. Report an issue: GitHub.