You have requested a non-existent parameter "api_private_key" after a PrestaShop upgrade

What happened#

Since 8.1 the back office includes an OAuth2 server for the Admin API, and its service reads two parameters: api_private_key and api_public_key. A fresh install writes an RSA key pair into app/config/parameters.php. A store that started on 1.7 or 8.0 has no such keys.

When you upgrade to 8.1 or later with the Update Assistant (the autoupgrade module), its database step generates the pair with PHP's OpenSSL extension and adds it to parameters.php. If the keys are missing after an upgrade, that step did not run or did not work:

• the upgrade was done another way: new files copied by hand, an old version of the Update Assistant, or parameters.php restored from a backup afterwards;
• OpenSSL was missing or not working in the PHP that ran the upgrade. With a command line upgrade that PHP can differ from the web server's one: php -m should list openssl.

On our PrestaShop 9.2 test store, removing both keys gave error 500 in the back office with exactly this message, and the cache could not be built.

The fix#

You do not need to run the whole upgrade again. Generate the pair the same way the PrestaShop installer does (2048-bit RSA with openssl_pkey_new). Save this as gen-api-keys.php in the store root:

<?php
// Adds the api_public_key / api_private_key pair that PrestaShop 8.1+ expects
// in app/config/parameters.php. Run once from the shop root: php gen-api-keys.php
$path = __DIR__ . '/app/config/parameters.php';
$p = require $path;
if (!empty($p['parameters']['api_private_key']) && !empty($p['parameters']['api_public_key'])) {
    exit("Keys already present, nothing to do.\n");
}
$key = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
if ($key === false) {
    exit('OpenSSL could not create a key: ' . openssl_error_string() . "\n");
}
openssl_pkey_export($key, $private);
$p['parameters']['api_private_key'] = $private;
$p['parameters']['api_public_key'] = openssl_pkey_get_details($key)['key'];
copy($path, $path . '.bak');
file_put_contents($path, '<?php return ' . var_export($p, true) . ';');
echo "Keys added. Backup: app/config/parameters.php.bak\n";

Then:

php gen-api-keys.php
rm -rf var/cache/prod var/cache/dev
rm gen-api-keys.php

On Linux, run it as the web server user, so parameters.php keeps its owner. We tested it on 9.2.0: without the keys the back office gave error 500 with this message; after the script and a cache clear it opened again.

If the script says OpenSSL could not create a key, the OpenSSL extension of that PHP is not working. Fix it first, or ask the host. Do not copy a key pair from another store or from a tutorial: the private key signs the back office API tokens, so each store needs its own.

Where else it hides#

Other non-existent parameter errors right after an upgrade usually mean the same thing: the upgrade did not finish its settings step. In that case, adding parameters by hand one at a time is the wrong road. Restore the backup and run the upgrade again with the current Update Assistant, from a PHP that has OpenSSL.