Graphql-engine: Error: cannot create migrate instance: Data Error: {"path":"$","error":"invalid x-hasura-admin-secret/x-hasura-access-key","code":"access-denied"} with docker compose + hasura cli + postgres password + hasura secret key

[bionicles]

this is currently wrecking my first day with hasura! just want to run postgres + hasura locally with docker-compose and login to the hasura console to try some migrations, but the secret isn't working.

I wanted to test with a secret locally because this helps with dev-prod parity (i'm a 12-factor optimist)

~/hax/bp $ make console
source .env && echo $HASURA_ADMIN_SECRET && cd hasura && hasura console --admin-secret $HASURA_ADMIN_SECRET
Error: cannot create migrate instance: Data Error: {"path":"$","error":"invalid x-hasura-admin-secret/x-hasura-access-key","code":"access-denied"}
make: *** [console] Error 1

logs from docker-compose:

cd /Users/bionhoward/hax/bp && /usr/local/bin/docker-compose up --build -d --force-recreate && /usr/local/bin/docker-compose logs --tail=1000 -f -t
Creating network "bp_default" with the default driver
Building www
Step 1/6 : FROM node:12-alpine
 ---> b0dc3a5e5e9e
Step 2/6 : RUN mkdir -p /usr/src/app
 ---> Using cache
 ---> 9f6ae3936f61
Step 3/6 : WORKDIR /usr/src/app
 ---> Using cache
 ---> 85f913f6b808
Step 4/6 : COPY . .
 ---> Using cache
 ---> f9927749b23a
Step 5/6 : RUN yarn
 ---> Using cache
 ---> 750bba23d849
Step 6/6 : CMD [ "yarn", "dev" ]
 ---> Using cache
 ---> 1d465af12048

Successfully built 1d465af12048
Successfully tagged bp_www:latest
Creating bp_postgres_1 ... done
Creating bp_graphql-engine_1 ... done
Creating bp_www_1            ... done
Attaching to bp_www_1, bp_graphql-engine_1, bp_postgres_1
www_1             | 2020-01-19T04:21:04.626764700Z yarn run v1.21.1
www_1             | 2020-01-19T04:21:04.726816700Z $ next dev
www_1             | 2020-01-19T04:21:05.350309100Z [ wait ]  starting the development server ...
www_1             | 2020-01-19T04:21:05.353517100Z [ info ]  waiting on http://localhost:3000 ...
graphql-engine_1  | 2020-01-19T04:20:56.900230100Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"server_configuration","info":{"live_query_options":{"batch_size":100,"refetch_delay":1},"transaction_isolation":"ISOLATION LEVEL READ COMMITTED","plan_cache_options":{"plan_cache_size":null},"enabled_log_types":["http-log","websocket-log","startup","webhook-log","query-log"],"server_host":"HostAny","enable_allowlist":false,"log_level":"info","auth_hook_mode":null,"use_prepared_statements":true,"unauth_role":null,"stringify_numeric_types":false,"enabled_apis":["metadata","graphql","config","pgdump"],"enable_telemetry":true,"enable_console":true,"auth_hook":null,"jwt_secret":null,"cors_config":{"allowed_origins":"*","disabled":false,"ws_read_cookie":null},"console_assets_dir":null,"admin_secret_set":true,"port":8080}}}
graphql-engine_1  | 2020-01-19T04:20:57.901261800Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"postgres_connection","info":{"retries":1,"database_url":"postgres://postgres:...@postgres:5432/postgres"}}}
graphql-engine_1  | 2020-01-19T04:20:57.901299100Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"db_migrate","info":"Already at the latest catalog version (28); nothing to do."}}
graphql-engine_1  | 2020-01-19T04:20:57.901332000Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"schema-sync","info":{"thread_id":"ThreadId 16","instance_id":"629b0727-ec04-4e33-8808-b344efc07b7f","message":"listener thread started"}}}
graphql-engine_1  | 2020-01-19T04:20:57.901445100Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"schema-sync","info":{"thread_id":"ThreadId 17","instance_id":"629b0727-ec04-4e33-8808-b344efc07b7f","message":"processor thread started"}}}
graphql-engine_1  | 2020-01-19T04:20:57.901468100Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"event_triggers","info":"preparing data"}}
graphql-engine_1  | 2020-01-19T04:20:57.901490500Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"event_triggers","info":"starting workers"}}
graphql-engine_1  | 2020-01-19T04:20:57.901513000Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"telemetry","info":"Help us improve Hasura! The graphql-engine server collects anonymized usage stats which allows us to keep improving Hasura at warp speed. To read more or opt-out, visit https://docs.hasura.io/1.0/graphql/manual/guides/telemetry.html"}}
graphql-engine_1  | 2020-01-19T04:20:57.901535800Z {"type":"startup","timestamp":"2020-01-19T04:20:56.899+0000","level":"info","detail":{"kind":"server","info":{"time_taken":0.3315586,"message":"starting API server"}}}
postgres_1        | 2020-01-19T04:20:55.693673000Z 2020-01-19 04:20:55.693 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1        | 2020-01-19T04:20:55.693766900Z 2020-01-19 04:20:55.693 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1        | 2020-01-19T04:20:55.700556500Z 2020-01-19 04:20:55.699 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1        | 2020-01-19T04:20:55.730896200Z 2020-01-19 04:20:55.730 UTC [18] LOG:  database system was shut down at 2020-01-19 04:20:27 UTC
postgres_1        | 2020-01-19T04:20:55.734346700Z 2020-01-19 04:20:55.733 UTC [1] LOG:  database system is ready to accept connections
www_1             | 2020-01-19T04:21:11.974804400Z [ ready ] compiled successfully - ready on http://localhost:3000

docker-compose.yml

version: "3.7"

services:
  postgres:
    image: postgres:11.4-alpine
    restart: always
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
  graphql-engine:
    depends_on: [postgres]
    image: hasura/graphql-engine:v1.0.0
    ports:
      - "8080:8080"
    restart: always
    environment:
      HASURA_GRAPHQL_DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
      HASURA_GRAPHQL_ENABLE_CONSOLE: "true" # set to "false" to disable console
      HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, webhook-log, websocket-log, query-log
      ## uncomment next line to set an admin secret
      HASURA_GRAPHQL_ADMIN_SECRET: ${HASURA_ADMIN_SECRET}
  www:
    depends_on: [graphql-engine]
    build:
      context: ./www
    environment:
      - API=http://localhost:8080
      - NODE_ENV=production
      - PORT=3000
    volumes:
      - ./www:/usr/src/app
      - /usr/src/app/node_modules
    ports:
      - "127.0.0.1:3000:3000"
    healthcheck:
      test: curl -s -o /dev/null -w "%{http_code}" localhost:3000 | grep -q 2
volumes:
  db_data:

env vars located in .env seem to be working as they can be echo'd in shell

[bionicles]

used "hasura init" and "hasura login" if that matters. I'm new to hasura and not sure if it's just my dumb error

[shahidhk]

What is the cli version? At a first look i cannot find anything wrong with the setup.

If the version says 0.49.0, try reinstalling the cli from https://docs.hasura.io/1.0/graphql/manual/hasura-cli/install-hasura-cli.html

[webdeb]

@bionicles I can remember having something similar with my local setup and env variables,
however config.yaml worked for me. and no need to provide --admin-secret any more.

endpoint: http://localhost:8080
admin_secret: your-secret

just exclude it from git and maybe checkin a config.sample.yaml for your team

[bionicles]

worked. please document. closing. thank you :)