upstash/context7 · warning

API key should start with '${API_KEY_PREFIX}'

Error message

API key should start with '${API_KEY_PREFIX}'

What it means

console.warn from the Context7Client constructor (packages/sdk/src/client.ts): an API key was found (config.apiKey or CONTEXT7_API_KEY) but it does not start with the expected 'ctx7sk' prefix. The client still constructs and sends the key as a Bearer token, so requests will typically fail downstream with 401/403 — the warn is an early hint that the key is wrong-truncated-or-from-another-provider.

Source

Thrown at packages/sdk/src/client.ts:38

  RateLimitMetadata,
  RetryConfig,
} from "@http";
export * from "@error";

export class Context7 {
  private readonly httpClient: HttpClient;

  constructor(config: Context7Config = {}) {
    const apiKey = config.apiKey || getEnvironmentApiKey();

    if (!apiKey) {
      throw new Context7Error(
        "API key is required. Pass it in the config or set CONTEXT7_API_KEY environment variable."
      );
    }

    if (!apiKey.startsWith(API_KEY_PREFIX)) {
      console.warn(`API key should start with '${API_KEY_PREFIX}'`);
    }

    this.httpClient = new HttpClient({
      baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
      headers: {
        ...withoutAuthorizationHeader(config.headers),
        Authorization: `Bearer ${apiKey}`,
      },
      retry: config.retry,
      cache: config.cache ?? "no-store",
      timeout: config.timeout,
      signal: config.signal,
      keepAlive: config.keepAlive,
      fetch: config.fetch,
      onResponse: config.onResponse,
    });
  }

View on GitHub (pinned to 80e681a507)

Solutions

1. Regenerate/copy the key from the Context7 dashboard and confirm it starts with `ctx7sk`
2. Strip whitespace/newlines when loading: `process.env.CONTEXT7_API_KEY?.trim()`
3. Inspect the env var for invisible characters: `printenv CONTEXT7_API_KEY | cat -A`
4. If set in shell profile or .env, remove surrounding quotes and re-source

Example fix

// before
const client = new Context7Client(); // CONTEXT7_API_KEY="ctx7sk-..." (with quotes) -> warn

// after
const apiKey = process.env.CONTEXT7_API_KEY?.trim().replace(/^"|"$/g, "");
const client = new Context7Client({ apiKey });

// Validate and normalize the key BEFORE constructing the client
const rawKey = (config.apiKey ?? process.env.CONTEXT7_API_KEY ?? "").trim();
if (!rawKey) {
  throw new Error("CONTEXT7_API_KEY is required");
}
if (!rawKey.startsWith("ctx7sk")) {
  throw new Error(
    `Context7 API key must start with 'ctx7sk' (got '${rawKey.slice(0, 6)}...') — check for stray quotes/whitespace or a wrong-vendor key`
  );
}
const client = new Context7Client({ apiKey: rawKey });

function isPlausibleContext7Key(key: unknown): key is string {
  return (
    typeof key === "string" &&
    key === key.trim() && // no surrounding whitespace
    !key.includes('"') &&
    key.startsWith("ctx7sk") &&
    key.length > "ctx7sk".length + 8 // prefix plus a non-trivial body
  );
}

When it happens

Trigger: Set CONTEXT7_API_KEY to an OpenAI/Anthropic/other-vendor key by mistake; copy-pasted the key with a leading quote, space, or trailing newline (e.g. from an .env with quoted values or a clipboard artifact); truncated key; legacy or rotated key format.

Common situations: Shared .env files where the variable was pasted with quotes (`CONTEXT7_API_KEY="ctx7sk-..."`) so the value starts with a quote; CI secrets with an invisible trailing \n; users reusing the wrong vendor's key out of muscle memory; keys copied from a dashboard diff view picking up line numbers.

Related errors

• API key is required. Pass it in the config or set CONTEXT7_A
• errorBody.error || errorBody.message || res.statusText
• Request did not return a result
• Request did not return a result
• Request did not return a result

AI-assisted analysis of upstash/context7@80e681a507 (2026-08-18). Data as JSON: /api/errors/48e27f185c06f43f. Report an issue: GitHub.