vercel/ai · error · TypeError

Continuation signing key must not be empty.

Error message

Continuation signing key must not be empty.

What it means

resolveCodeModeContinuationSecurity converts the configured signing key into a Buffer and throws a TypeError if the resulting key has zero bytes. The key signs HMAC-SHA256 continuation tokens, and an empty key would make signatures trivially forgeable, so the library refuses it outright. It is thrown when calling setCodeModeContinuationSigningKey, signCodeModeContinuation, or verifyCodeModeContinuation with an empty key.

Source

Thrown at packages/code-mode/src/continuation-capability.ts:43

  const resolved = resolveCodeModeContinuationSecurity({
    signingKey: key ?? randomBytes(32),
    maxAgeMs: options.maxAgeMs ?? DEFAULT_MAX_AGE_MS,
  });
  defaultSigningKey = resolved.signingKey;
  defaultMaxAgeMs = resolved.maxAgeMs;
}

export function resolveCodeModeContinuationSecurity(
  options: CodeModeContinuationSecurityOptions = {},
): ResolvedCodeModeContinuationSecurity {
  const signingKey =
    options.signingKey === undefined
      ? Buffer.from(defaultSigningKey)
      : typeof options.signingKey === 'string'
        ? Buffer.from(options.signingKey)
        : Buffer.from(options.signingKey);
  if (signingKey.byteLength === 0) {
    throw new TypeError('Continuation signing key must not be empty.');
  }

  const maxAgeMs = options.maxAgeMs ?? defaultMaxAgeMs;
  if (
    !Number.isInteger(maxAgeMs) ||
    !Number.isFinite(maxAgeMs) ||
    maxAgeMs <= 0
  ) {
    throw new TypeError('Continuation maxAgeMs must be a positive integer.');
  }

  return { signingKey, maxAgeMs };
}

export function signCodeModeContinuation(
  continuation: UnsignedCodeModeContinuation,
  security = resolveCodeModeContinuationSecurity(),
): CodeModeContinuation {

View on GitHub (pinned to 69428b1f8b)

Solutions

1. Set the signing key to a non-empty value, e.g. setCodeModeContinuationSigningKey(process.env.CONTINUATION_SIGNING_KEY)
2. Fail fast at startup: read the env var and throw your own clear error if it is missing or empty before calling the API
3. Generate a strong key if none exists, e.g. call setCodeModeContinuationSigningKey() with no argument to use randomBytes(32)
4. Verify the upstream secret source actually returned a value (check secret name/region/permissions)

Example fix

// before
const key = process.env.CONTINUATION_SIGNING_KEY ?? '';
setCodeModeContinuationSigningKey(key); // TypeError: must not be empty
// after
const key = process.env.CONTINUATION_SIGNING_KEY;
if (!key || key.length === 0) {
  throw new Error('CONTINUATION_SIGNING_KEY is required');
}
setCodeModeContinuationSigningKey(key);

const key = process.env.CONTINUATION_SIGNING_KEY;
if (typeof key !== 'string' || key.length === 0) {
  throw new Error('CONTINUATION_SIGNING_KEY must be a non-empty string');
}
setCodeModeContinuationSigningKey(key);

function hasNonEmptyKey(k: string | Uint8Array | undefined): k is string | Uint8Array {
  if (k === undefined) return false;
  return (typeof k === 'string' ? k.length : k.byteLength) > 0;
}

try {
  setCodeModeContinuationSigningKey(key);
} catch (error) {
  if (error instanceof TypeError && /signing key must not be empty/.test(error.message)) {
    throw new Error('Refusing to start: continuation signing key is empty. Check CONTINUATION_SIGNING_KEY.');
  }
  throw error;
}

When it happens

Trigger: Calling setCodeModeContinuationSigningKey('') or new Uint8Array(0); passing a signingKey option resolved from an env var that is undefined and defaulted to '' (e.g. process.env.KEY ?? ''); passing a zero-length Buffer; a key string that is empty after upstream trimming or secret-manager lookup returning an empty value.

Common situations: Missing CONTINUATION_SIGNING_KEY environment variable silently defaulted to empty string; config loader stripping values; storing the key in a secret manager that returned empty during startup; copying code with placeholder key '' left in place.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• ACP runtime environment key ${JSON.stringify(key)} cannot be
• Invalid argument for parameter model: model ${model.provider
• Unsupported output: ${_exhaustiveCheck}
• Invalid argument for parameter output: Invalid output type.
• Model could not be resolved

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/032ac340858c2605. Report an issue: GitHub.