[BUG] api key expires even when set to 'never expire'

English Forum Questions
1

* Describe the bug

* Environment

  • NocoBase version: v2.2.8
  • Database type and version: Postgres
  • OS: Linux
  • Deployment Methods: docker
  • Docker image version: latest

* How To Reproduce

use the @nocobase/api-key plugina nd create an api key and set expire to ‘never’. not even 3 months has passed and I found out that it expired. maybe it was because I migrated database. might be worth looking into the code.

Expected behavior

it should’ve never expires

2

A key created with “Never” cannot expire on its own: NocoBase stores expiresIn as never and signs the token with an expiry about 1000 years away (year 3026), so time is not what invalidated your key.

After a database migration, the usual cause is the token secret. An API key is a JWT signed with your instance secret, which comes from the APP_KEY environment variable, or, when APP_KEY is not set, from an auto-generated file at storage/apps/main/jwt_secret.dat. If the new environment uses a different APP_KEY, or its storage directory was not carried over, every previously issued API key and login session becomes invalid, and requests then fail with 401 “Your session has expired. Please sign in again.”

Please check two things:

  1. On the API keys page, does the Expiration column for that key show “Never expires” or a date? A date means the saved value was not never.
  2. Which APP_KEY does each environment use? Configure APP_KEY explicitly with the same value in the new environment, keep the storage directory, then create a new API key.

If it still fails, send the HTTP status and response body of the failing request; the error code tells an invalid signature, a deleted key, and a missing user apart.

Reference: API Keys - NocoBase Documentation

1 Like
3

ok thank you