Soda Cloud "invalid API key" in CI

By Daniel Zoghalchali·Latchkey

Soda ran the scan but could not authenticate to Soda Cloud: the api_key_id/api_key_secret referenced in the configuration are missing or wrong in CI. The scan may still evaluate checks locally, but the Cloud push fails.

What this error means

The scan logs an authentication or unauthorized error against Soda Cloud, typically because the environment variables the config interpolates are not set from CI secrets.

[ERROR] Soda Cloud error: authentication failed (401).
Verify soda_cloud.api_key_id and soda_cloud.api_key_secret.

Common causes

The Cloud API key env vars are not set

The configuration.yml interpolates ${SODA_CLOUD_API_KEY_ID} and secret, but those variables were never exposed to the CI step.

A stale or wrong key pair

The key was rotated in Soda Cloud but the CI secret still holds the old value, so authentication is rejected.

How to fix it

Inject the key pair from CI secrets

1. Store the Soda Cloud key id and secret as repository or org secrets.
2. Expose them as env vars in the scan step.
3. Reference them in configuration.yml via interpolation.

env:
  SODA_CLOUD_API_KEY_ID: ${{ secrets.SODA_CLOUD_API_KEY_ID }}
  SODA_CLOUD_API_KEY_SECRET: ${{ secrets.SODA_CLOUD_API_KEY_SECRET }}

Rotate and update the secret

If the key was rotated, generate a new pair in Soda Cloud and update the CI secret so the values match.

soda_cloud:
  host: cloud.soda.io
  api_key_id: ${SODA_CLOUD_API_KEY_ID}
  api_key_secret: ${SODA_CLOUD_API_KEY_SECRET}

How to prevent it

• Keep Soda Cloud keys in CI secrets, never committed in config.
• Update the CI secret in one place when rotating keys.
• Fail the job on Cloud auth errors if pushing results is required.

Frequently asked questions

Related guides

References

• GitHub Actions documentation