zeroclaw-labs/zeroclaw · error · anyhow::Error

auth_secret must be 64 characters or fewer

Error message

auth_secret must be 64 characters or fewer

What it means

Thrown by HttpRequestTool::validate_secret_name (crates/zeroclaw-tools/src/http_request.rs:268) when the auth_secret name exceeds 64 bytes. Secret names are used as config.toml table keys and log identifiers, so they are capped at a fixed small length; the limit is measured with .len() (bytes), so multi-byte characters count extra.

Source

Thrown at crates/zeroclaw-tools/src/http_request.rs:268

                    anyhow::bail!("Header '{key}' value must be a string, got: {}", value);
                };
                let header_name = HeaderName::from_str(key)
                    .map_err(|e| anyhow::Error::msg(format!("Invalid header name '{key}': {e}")))?;
                let header_value = HeaderValue::from_str(str_val).map_err(|e| {
                    anyhow::Error::msg(format!("Invalid value for header '{key}': {e}"))
                })?;
                result.insert(header_name, header_value);
            }
        }
        Ok(result)
    }

    fn validate_secret_name(secret_name: &str) -> anyhow::Result<()> {
        if secret_name.is_empty() {
            anyhow::bail!("auth_secret cannot be empty");
        }
        if secret_name.len() > 64 {
            anyhow::bail!("auth_secret must be 64 characters or fewer");
        }
        if !secret_name
            .chars()
            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
        {
            anyhow::bail!(
                "auth_secret must contain only ASCII letters, numbers, underscores, or hyphens"
            );
        }
        Ok(())
    }

    fn resolve_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {
        Self::validate_secret_name(secret_name)?;
        self.reload_auth_secret(secret_name)
    }

    fn reload_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Shorten the secret key to 64 bytes or fewer, e.g. "stripe_prod_webhook", and rename the matching [http_request.secrets] entry.
2. If names are generated, hash or truncate deterministically and keep a mapping.
3. Make sure you are passing the secret's name, not its value, in auth_secret.

Example fix

# before
[http_request.secrets]
"production_stripe_webhook_signing_token_v2_2026" = "..."

# after
[http_request.secrets]
stripe_prod_webhook = "..."
// caller: {"auth_secret": "stripe_prod_webhook"}

fn secret_name_length_ok(name: &str) -> bool {
    !name.is_empty() && name.len() <= 64
}

let result = tool.execute(args).await?;
if let Some(err) = &result.error {
    if err.contains("64 characters or fewer") {
        // rename the secret key in config.toml and the caller to something short
    }
}

When it happens

Trigger: auth_secret set to a fully-qualified descriptive name like "production stripe webhook signing token v2 2026" (> 64 bytes); passing a path or a whole token string as the name; auto-generated names from service URLs or ARNs that exceed the cap; names with many non-ASCII characters where byte length outruns character count.

Common situations: Machine-generated secret identifiers (ARNs, URNs, host-based names); copy-pasting the secret value instead of its name; naming conventions that encode environment + service + purpose into one long key.

Related errors

• auth_secret cannot be empty
• auth_secret must contain only ASCII letters, numbers, unders
• environment-backed auth_secret '{inner}' must contain only A
• auth_secret requires a config.toml path
• auth_secret '{secret_name}' is empty after decryption

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/8b3c92338be295eb. Report an issue: GitHub.