Split.io "you passed a browser type api_key" / invalid SDK key in CI

By Kaveh Alemi·Latchkey

The Split.io factory validated the authorizationKey and rejected it as empty or the wrong type. Server-side SDKs need a server-side SDK key; passing a browser (client-side) key, or an empty string, stops the factory before any split loads.

What this error means

Split.io logs "Factory instantiation: you passed an invalid api_key, api_key must be a non-empty string" or a warning that a browser-type key was passed to a server SDK. The client never becomes ready.

[splitio] ERROR: Factory instantiation: you passed an invalid api_key,
api_key must be a non-empty string.

Common causes

The SDK key is empty or not injected into CI

The secret was not exposed to the job, so authorizationKey is an empty string and the factory rejects it.

A browser-side key used with the server SDK

Split server SDKs require a server-side key; a client-side (browser) key is flagged as the wrong type.

How to fix it

Inject the server-side SDK key from a secret

1. Copy the server-side SDK key from the Split admin settings for the environment.
2. Store it as a CI secret and pass it as authorizationKey.
3. Confirm it is the server-side key, not a browser key.

const factory = SplitFactory({
  core: { authorizationKey: process.env.SPLIT_SDK_KEY },
});

Use localhost mode when no live key is needed

For tests that do not need the real backend, use the "localhost" key to serve treatments from a local map.

const factory = SplitFactory({ core: { authorizationKey: 'localhost' } });

How to prevent it

• Keep the Split SDK key in CI secrets, never committed.
• Use the server-side key for backend SDKs and the browser key only on the client.
• Prefer localhost mode in tests to avoid needing a live key.

Frequently asked questions

Related guides

References

• GitHub Actions documentation