weaviate/weaviate · error

invalid token

Error message

invalid token

What it means

DecodeApiKey base64-decoded the presented API key successfully but the decoded payload did not split into exactly three underscore-separated parts (user, random key, version marker). This is a format guard: the token is structurally not a Weaviate-issued dynamic-user key — usually a static API key or arbitrary string presented to the dynamic-user auth path.

Source

Thrown at usecases/auth/authentication/apikey/keys/key_generation.go:99

	b := make([]byte, length)
	_, err := rand.Read(b)
	// Note that err == nil only if we read len(b) bytes.
	if err != nil {
		return nil, err
	}

	return b, nil
}

func DecodeApiKey(fullApiKey string) (string, string, error) {
	decodeString, err := base64.StdEncoding.DecodeString(fullApiKey)
	if err != nil {
		return "", "", err
	}

	parts := strings.Split(string(decodeString), "_")
	if len(parts) != 3 {
		return "", "", fmt.Errorf("invalid token")
	}

	userIdentifier := parts[0]
	randomKey := parts[1]
	version := parts[2]
	if version != DynUserIdentifier {
		return "", "", fmt.Errorf("invalid token")
	}

	if len(userIdentifier) != UserIdentifierBytesBase64Length {
		return "", "", fmt.Errorf("invalid token")
	}

	if len(randomKey) != RandomBytesBase64Length {
		return "", "", fmt.Errorf("invalid token")
	}

	return randomKey, userIdentifier, nil

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Confirm the client is sending a dynamically generated API key, not a static one
2. Check the key was copied fully without truncation or extra whitespace
3. Regenerate the key via the users API if its format is suspect
4. Route static keys to the static API-key auth scheme instead

When it happens

Trigger: Thrown at usecases/auth/authentication/apikey/keys/key_generation.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/a5c460fec6a33aa1. Report an issue: GitHub.