weaviate/weaviate · error

keys must be unique

Error message

keys must be unique

What it means

Static API-key auth configuration lists the same key more than once in AllowedKeys. The duplicate check via seenKeys map fires during validation because duplicate keys would create ambiguous user-to-key mapping when Users are also configured. Usually a copy-paste or env-var concatenation mistake.

Source

Thrown at usecases/auth/authentication/apikey/client.go:65

}

func (c *StaticApiKey) validateConfig() error {
	if !c.config.Enabled {
		// don't validate if this scheme isn't used
		return nil
	}

	if len(c.config.AllowedKeys) < 1 {
		return fmt.Errorf("need at least one valid allowed key")
	}

	seenKeys := make(map[string]struct{}, len(c.config.AllowedKeys))
	for _, key := range c.config.AllowedKeys {
		if len(key) == 0 {
			return fmt.Errorf("keys cannot have length 0")
		}
		if _, ok := seenKeys[key]; ok {
			return fmt.Errorf("keys must be unique")
		}
		seenKeys[key] = struct{}{}
	}

	if len(c.config.Users) < 1 {
		return fmt.Errorf("need at least one user")
	}

	for _, key := range c.config.Users {
		if len(key) == 0 {
			return fmt.Errorf("users cannot have length 0")
		}
	}

	if len(c.config.Users) > 1 && len(c.config.Users) != len(c.config.AllowedKeys) {
		return fmt.Errorf("length of users and keys must match, alternatively provide single user for all keys")
	}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Remove the duplicate entry so each key appears once
2. Generate distinct keys per user (e.g. openssl rand -hex 32)
3. If two users should share access, give them distinct keys or use a single user for all keys

Example fix

// before
AUTHENTICATION_APIKEY_ALLOWED_KEYS=key1,key1
// after
AUTHENTICATION_APIKEY_ALLOWED_KEYS=key1,key2

seen := map[string]struct{}{}
for _, k := range strings.Split(os.Getenv("AUTHENTICATION_APIKEY_ALLOWED_KEYS"), ",") {
  if _, dup := seen[k]; dup { return fmt.Errorf("duplicate api key in ALLOWED_KEYS") }
  seen[k] = struct{}{}
}

When it happens

Trigger: The same key string appears twice in AUTHENTICATION_APIKEY_ALLOWED_KEYS, e.g. 'key1,key1' or copying an existing key when adding a second one while configuring multiple users.

Common situations: Copy-paste of an existing key in Helm values or docker-compose; automation generating keys that accidentally collides.

Related errors

• invalid apikey config: %w
• need at least one valid allowed key
• keys cannot have length 0
• need at least one user
• users cannot have length 0

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/f646bbe07947fb7e. Report an issue: GitHub.