Budibase/budibase · error

CLOUDFRONT_PRIVATE_KEY_64 is not set

Error message

CLOUDFRONT_PRIVATE_KEY_64 is not set

What it means

cloudfront.ts signs CloudFront URLs using a private key that must be supplied base64-encoded in the CLOUDFRONT_PRIVATE_KEY_64 environment variable. getPrivateKey throws this error when that env var is unset. Without the key, no CloudFront URL can be signed.

Source

Thrown at packages/backend-core/src/objectStore/cloudfront.ts:8

import env from "../environment"
import * as cfsign from "aws-cloudfront-sign"

let PRIVATE_KEY: string | undefined

function getPrivateKey() {
  if (!env.CLOUDFRONT_PRIVATE_KEY_64) {
    throw new Error("CLOUDFRONT_PRIVATE_KEY_64 is not set")
  }

  if (PRIVATE_KEY) {
    return PRIVATE_KEY
  }

  PRIVATE_KEY = Buffer.from(env.CLOUDFRONT_PRIVATE_KEY_64, "base64").toString(
    "utf-8"
  )

  return PRIVATE_KEY
}

const getCloudfrontSignParams = () => {
  return {
    keypairId: env.CLOUDFRONT_PUBLIC_KEY_ID!,
    privateKeyString: getPrivateKey(),
    expireTime: new Date().getTime() + 1000 * 60 * 60 * 24, // 1 day

View on GitHub (pinned to a81a902e9a)

Solutions

1. Set CLOUDFRONT_PRIVATE_KEY_64 to the base64-encoded CloudFront private key (.pem contents) in the environment of the failing service
2. Restart the server/worker processes so the new env var is picked up
3. Verify with the CloudFront key pair: the key must match the CLOUDFRONT key pair ID configured for the distribution
4. If not using CloudFront, correct the object store configuration so the CloudFront signing path is not taken

Example fix

// before (.env)
# CLOUDFRONT_PRIVATE_KEY_64 not set
// after (.env)
CLOUDFRONT_PRIVATE_KEY_64=$(base64 -w0 pk-APXXXXXXXX.pem)

if (!process.env.CLOUDFRONT_PRIVATE_KEY_64) {
  throw new Error("Set CLOUDFRONT_PRIVATE_KEY_64 (base64 of the CloudFront .pem) before starting")
}
const decoded = Buffer.from(process.env.CLOUDFRONT_PRIVATE_KEY_64, "base64").toString()
if (!decoded.includes("PRIVATE KEY")) throw new Error("CLOUDFRONT_PRIVATE_KEY_64 does not decode to a PEM private key")

function hasCloudfrontKey(env): env is { CLOUDFRONT_PRIVATE_KEY_64: string } {
  return typeof env.CLOUDFRONT_PRIVATE_KEY_64 === "string" && env.CLOUDFRONT_PRIVATE_KEY_64.length > 0
}

try {
  const signedUrl = await getSignedUrl(params)
} catch (err) {
  if (String(err.message) === "CLOUDFRONT_PRIVATE_KEY_64 is not set") {
    // fail fast at startup instead: check the env var during boot and abort with clear instructions
  }
}

When it happens

Trigger: Any call chain reaching getCloudfrontSignParams (e.g. generating signed URLs for object store assets) while CLOUDFRONT_PRIVATE_KEY_64 is missing from the environment.

Common situations: Self-hosted deployment using CloudFront object store without setting the env var; key set in one service (server) but not another (worker); docker-compose/.env file missing the variable; variable set after process start without restart.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• JS disabled in environment.
• Workspace DB not found - self-host users using cloud don't h
• CouchDB username not set
• CouchDB password not set
• No google configuration found

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/844ced32410d3338. Report an issue: GitHub.