Skip to content

Credential or secret errors

Secret errors usually show up as failed tool calls, refused LLM requests, or authentication failures in the worklog. Because Alquimia Platform resolves secrets at runtime, the agent spec can be correct while the secret store is not.

SymptomLikely cause
secret not foundThe referenced secret name does not exist in the agentspace or global scope.
access deniedThe runtime role lacks permission to read the secret path.
Token rejected by providerThe secret value is expired, revoked, or copied incorrectly.
Intermittent failuresVault lease expired or dynamic credential renewal failed.
Secret fetch spikeA tool or loop is resolving secrets repeatedly.
  1. Identify the failing secret name from the worklog or error message.

  2. Check that the secret exists in the expected scope: global, agentspace, or local.

  3. Verify Vault policies allow the runtime role to read the relevant path.

  4. Test the secret value directly against the provider or database to confirm it is valid.

  5. Review secret audit metrics for spikes or failures associated with the agent.

  6. Confirm the runtime is using the intended auth method for Vault or the cluster secret store.

  • Register the missing secret or correct the reference name in the spec.
  • Update Vault policies to include the required paths.
  • Rotate the secret if the value is expired or invalid.
  • For dynamic credentials, check Vault role TTLs and renewal settings.
  • Refactor tools that resolve secrets inside loops to avoid unnecessary fetches.