[BUG] API Key Description Length Validation and 500 Error Handling

Author: arindam-sahooCreated Jan 27, 2025Updated Sep 16, 2026

LabelsA-errors

Currently, users are allowed to provide a description for an Api Key, but there is no proper validation for the description length (256 characters). When a description exceeds the desired length, the backend returns a 500 Internal Server Error, which is not handled appropriately. This leads to a lack of clarity about the issue.

How to Reproduce this issue:

Case: A description of length more than 256 characters.

Request cURL

curl

curl --location 'https://integ.hyperswitch.io/api/api_keys/merchant_id' \
--header 'authorization: authorization_token' \
--header 'content-type: application/json' \
--header 'origin: https://integ.hyperswitch.io' \
--header 'referer: https://integ.hyperswitch.io/dashboard/developer-api-keys' \
--data '{
    "name": "API Key Title",
    "description": "LoremipsumdolorsitametconsecteturadipiscingelitSeddoeiusmodtemporincididuntutlaboreetdoloremagnaaliquaUtenimadminimveniamquisnostrudexercitationullamcolaborisnisigutaliquipexeacommodoconsequatDuisauterure dolorinreprehenderitenvoluptatevelitessecillumyaaabc",
    "expiration": "never"
}'

Response JSON

json

{
    "error": {
        "type": "api",
        "message": "Something went wrong",
        "code": "HE_00"
    }
}

Case: A description with a desired length.

Request cURL

curl

curl --location 'https://integ.hyperswitch.io/api/api_keys/merchant_id' \
--header 'authorization: authorization_token' \
--header 'content-type: application/json' \
--header 'origin: https://integ.hyperswitch.io' \
--header 'referer: https://integ.hyperswitch.io/dashboard/developer-api-keys' \
--data '{
    "name": "API Key Title",
    "description": "LoremipsumdolorsitametconsecteturadipiscingelitSeddoeiusmodtemporincididuntutlaboreetdoloremagnaaliquaUtenimadminimveniamquisnostrudexercitationullamcolaborisnisigutaliquipexeacommodoconsequatDuisauterure dolorinreprehenderitenvoluptatevelitessecillumyaaab",
    "expiration": "never"
}'

Response JSON

json

{
    "key_id": "key_id",
    "merchant_id": "merchant_id",
    "name": "API Key Title",
    "description": "LoremipsumdolorsitametconsecteturadipiscingelitSeddoeiusmodtemporincididuntutlaboreetdoloremagnaaliquaUtenimadminimveniamquisnostrudexercitationullamcolaborisnisigutaliquipexeacommodoconsequatDuisauterure dolorinreprehenderitenvoluptatevelitessecillumyaaab",
    "prefix": "snd_WoGAtnVx",
    "created": "2025-01-21T11:56:13.041Z",
    "expiration": "never"
}

Expected Behavior:

The server return a meaningful error message when the input exceeds the allowed length which is 256 characters.

Actual Behavior:

The server returns a 500 Internal Server Error without handling the issue gracefully.

Note

This is a case both for creating and updating the Api Key.

Source: juspay/hyperswitch

View original on GitHub View discussion on GitHub