wso2 / wso2/api-platform

[Bug]: Inconsistency in the API Key creation flow

Open
#1,910 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area/Gateway Area/Management Aspect/API Severity/Critical Type/Bug
Dominant language
Go
Stars
71
Forks
111
Avg merge
1d 14h
Merged PRs (30d)
110

Description

Please select the area the issue is related to

Area/Management (Management API or Management Portal UI), Area/Gateway (Routing, API deployment in gateway etc.)

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

When I send multiple API Key generation requests for an API in the self-hosted gateway, it returns successful responses. However, according to the logs, only the initial request succeeds while the subsequent requests fail.

gateway-controller-1  | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/utils/api_key.go:352 msg="API key successfully created" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd handle=reading-list-api-v1.0 correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd user_id=admin name=my-production-key operation=generate_key is_retry=false
gateway-controller-1  | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/api/handlers/api_key_handler.go:105 msg="API key creation completed" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd handle=reading-list-api-v1.0 "key name"=my-production-key user=admin correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1  | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/api/middleware/logging.go:49 msg="HTTP request" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd method=POST path=/rest-apis/reading-list-api-v1.0/api-keys query="" status=201 latency=110.982184ms client_ip=172.21.0.1 user_agent=PostmanRuntime/7.54.0
gateway-controller-1  | time=2026-05-08T04:39:07.577Z level=INFO source=/build/pkg/eventlistener/listener.go:193 msg="Processing replica sync event" event_type=API_KEY action=CREATE entity_id=019e05e0-9f56-7614-a3f0-31afd8440b46_019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 event_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1  | time=2026-05-08T04:39:07.577Z level=INFO source=/build/pkg/eventlistener/apikey_processor.go:78 msg="Processing API key upsert event" action=CREATE api_id=019e05e0-9f56-7614-a3f0-31afd8440b46 api_key_id=019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 event_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1  | time=2026-05-08T04:39:07.577Z level=ERROR source=/build/pkg/eventlistener/apikey_processor.go:109 msg="Failed to store API key in memory store" api_key_id=019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 api_id=019e05e0-9f56-7614-a3f0-31afd8440b46 error="API key with name \"my-production-key\" already exists for artifact 019e05e0-9f56-7614-a3f0-31afd8440b46 with a different ID"

According to the logs, the database may have been updated successfully, but the in-memory store threw an error, leading to an inconsistent state.

Steps to Reproduce
  1. Create an API.
  2. Create an API Key for the above API.
  3. Send the same API Key creation request again and observe the successful REST response. However, error logs can be observed in the terminal.
Severity Level of the Issue

Severity/Critical (Core functionality is broken but there is a workaround. Need urgent attention)

Environment Details (with versions)

wso2apip-api-gateway-1.1.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with pkg/api/handlers/api_key_handler.go and pkg/eventlistener/apikey_processor.go, then trace the API-key flow through pkg/utils/api_key.go. Reproduce the repeated creation request and compare the REST response with the event-listener logs. Done means the response and database or in-memory state no longer diverge when a duplicate API key request is submitted.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.