[Bug]: Inconsistency in the API Key creation flow
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 71
- Forks
- 111
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 110
Description
Please select the area the issue is related to
Area/Management (Management API or Management Portal UI), Area/Gateway (Routing, API deployment in gateway etc.)
Please select the aspect the issue is related to
Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)
Description
When I send multiple API Key generation requests for an API in the self-hosted gateway, it returns successful responses. However, according to the logs, only the initial request succeeds while the subsequent requests fail.
gateway-controller-1 | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/utils/api_key.go:352 msg="API key successfully created" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd handle=reading-list-api-v1.0 correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd user_id=admin name=my-production-key operation=generate_key is_retry=false
gateway-controller-1 | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/api/handlers/api_key_handler.go:105 msg="API key creation completed" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd handle=reading-list-api-v1.0 "key name"=my-production-key user=admin correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1 | time=2026-05-08T04:39:06.077Z level=INFO source=/build/pkg/api/middleware/logging.go:49 msg="HTTP request" correlation_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd method=POST path=/rest-apis/reading-list-api-v1.0/api-keys query="" status=201 latency=110.982184ms client_ip=172.21.0.1 user_agent=PostmanRuntime/7.54.0
gateway-controller-1 | time=2026-05-08T04:39:07.577Z level=INFO source=/build/pkg/eventlistener/listener.go:193 msg="Processing replica sync event" event_type=API_KEY action=CREATE entity_id=019e05e0-9f56-7614-a3f0-31afd8440b46_019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 event_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1 | time=2026-05-08T04:39:07.577Z level=INFO source=/build/pkg/eventlistener/apikey_processor.go:78 msg="Processing API key upsert event" action=CREATE api_id=019e05e0-9f56-7614-a3f0-31afd8440b46 api_key_id=019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 event_id=4fa3e0b6-7613-4f54-9dc8-7273cb974acd
gateway-controller-1 | time=2026-05-08T04:39:07.577Z level=ERROR source=/build/pkg/eventlistener/apikey_processor.go:109 msg="Failed to store API key in memory store" api_key_id=019e05e1-d1f8-7e7e-bb55-9d6b9b2e4869 api_id=019e05e0-9f56-7614-a3f0-31afd8440b46 error="API key with name \"my-production-key\" already exists for artifact 019e05e0-9f56-7614-a3f0-31afd8440b46 with a different ID"
According to the logs, the database may have been updated successfully, but the in-memory store threw an error, leading to an inconsistent state.
Steps to Reproduce
- Create an API.
- Create an API Key for the above API.
- Send the same API Key creation request again and observe the successful REST response. However, error logs can be observed in the terminal.
Severity Level of the Issue
Severity/Critical (Core functionality is broken but there is a workaround. Need urgent attention)
Environment Details (with versions)
wso2apip-api-gateway-1.1.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with pkg/api/handlers/api_key_handler.go and pkg/eventlistener/apikey_processor.go, then trace the API-key flow through pkg/utils/api_key.go. Reproduce the repeated creation request and compare the REST response with the event-listener logs. Done means the response and database or in-memory state no longer diverge when a duplicate API key request is submitted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100