Statsig "Invalid key provided ... server secret key" in CI

By Daniel Zoghalchali·Latchkey

The Statsig server SDK validated the key and rejected it. Server SDKs require a server secret key that begins with "secret-"; passing a client key (starting with "client-") or an empty string is refused, and the SDK cannot initialize.

What this error means

Statsig throws or logs "Invalid key provided. Please check your Statsig console to get the right server secret key" when calling initialize. No gates or configs can be checked.

Error: Invalid key provided. Please check your Statsig console to get the
right server secret key. Provided key: client-...

Common causes

A client SDK key used with the server SDK

The value starts with "client-" but the server SDK requires a "secret-" key, so Statsig rejects it.

The secret key is empty or not injected into CI

The secret was not exposed to the job, so an empty string is passed and validation fails.

How to fix it

Inject the server secret key from a secret

1. Copy the server secret key (starting with "secret-") from the Statsig console.
2. Store it as a CI secret and pass it to initialize.
3. Confirm you are not using a "client-" key on the server SDK.

env:
  STATSIG_SERVER_SECRET_KEY: ${{ secrets.STATSIG_SERVER_SECRET_KEY }}

Use the key type matching the SDK

Server SDKs use "secret-" keys; client SDKs use "client-" keys. A mismatch is rejected and will not clear on retry.

How to prevent it

• Keep the Statsig server secret key in CI secrets, never committed.
• Use the "secret-" key on server SDKs and "client-" only on clients.
• Fail early when the key env var is empty.

Frequently asked questions

Related guides

References

• GitHub Actions documentation