srbhr/Resume-Matcher · warning · HTTPException

Confirmation required. Pass confirm=CLEAR_ALL_KEYS query par

Error message

Confirmation required. Pass confirm=CLEAR_ALL_KEYS query parameter.

What it means

A 400 HTTPException raised by delete_all_api_keys as a safety interlock: wiping every stored API key requires explicit confirmation via the confirm query parameter set to the exact string CLEAR_ALL_KEYS. This prevents accidental or CSRF-driven destruction of all credentials.

Source

Thrown at apps/backend/app/routers/config.py:617

@router.delete("/api-keys")
async def delete_all_api_keys(confirm: str | None = None) -> dict:
    """Clear all configured API keys.

    This is a destructive operation. Requires confirmation token.

    Args:
        confirm: Must be "CLEAR_ALL_KEYS" to execute

    Returns:
        Success message

    Note:
        This is a local-only endpoint for single-user deployments.
        In production/multi-user scenarios, add proper authentication.
    """
    if confirm != "CLEAR_ALL_KEYS":
        raise HTTPException(
            status_code=400,
            detail="Confirmation required. Pass confirm=CLEAR_ALL_KEYS query parameter.",
        )
    clear_all_api_keys()
    invalidate_config_cache()
    return {"message": "All API keys have been cleared"}


@router.delete("/api-keys/{provider}")
async def delete_api_key(provider: str) -> dict:
    """Delete API key for a specific provider.

    Args:
        provider: The provider name (openai, anthropic, google, openrouter, deepseek)

    Returns:
        Success message
    """

View on GitHub (pinned to 116f9cc3b0)

Solutions

Send the exact query parameter: ?confirm=CLEAR_ALL_KEYS
Ensure the value is in the URL query string, not the request body
Check exact casing — the comparison is against the literal CLEAR_ALL_KEYS

Example fix

// before
await api.deleteAllApiKeys()
// after
await api.deleteAllApiKeys({ params: { confirm: 'CLEAR_ALL_KEYS' } })

Defensive patterns

Strategy: validation

Validate before calling

function buildClearKeysUrl(base: string) {
  const url = new URL(base + '/config/api-keys')
  url.searchParams.set('confirm', 'CLEAR_ALL_KEYS')
  return url.toString()
}

Try / catch

try {
  await api.deleteAllApiKeys({ params: { confirm: 'CLEAR_ALL_KEYS' } })
} catch (e) {
  if (e.response?.status === 400 && String(e.response.data.detail).startsWith('Confirmation required')) {
    showToast('Pass confirm=CLEAR_ALL_KEYS as a query parameter')
  } else throw e
}

Prevention

Always send the literal confirm=CLEAR_ALL_KEYS query parameter
Double-check casing and that the param is in the query string, not the body
Gate destructive actions behind an explicit user confirmation dialog
Remember keys are destroyed irreversibly — export/back up keys first

When it happens

Trigger: DELETE the clear-all-keys endpoint without confirm, with a wrong value (e.g. confirm=true), or with the correct value sent in the body/header instead of the query string.

Common situations: Calling the endpoint from a script that forgot the query param; casing mismatch (clear_all_keys vs CLEAR_ALL_KEYS); proxies stripping the query string.

Related errors

AI-assisted analysis of srbhr/Resume-Matcher@116f9cc3b0 (2026-08-28). Data as JSON: /api/errors/2dd0117dde05b039. Report an issue: GitHub.