CherryHQ/cherry-studio · error · Error

Private key contains invalid characters (not valid Base64)

Error message

Private key contains invalid characters (not valid Base64)

What it means

After reconstructPemKey cleans the input to raw base64, it validates the remainder matches ^[A-Za-z0-9+/=]+$. Any other character means the content is not valid base64 and would produce an invalid key, so it throws. This catches keys that contain JSON, prose, or wrong encoding.

Source

Thrown at packages/aiCore/src/core/providers/core/utils.ts:86

}

/**
 * 重新构建 PEM 私钥
 */
function reconstructPemKey(key: string): string {
  // 移除所有空白字符和可能存在的不完整头尾
  let cleanKey = key.replace(/\s+/g, '')
  cleanKey = cleanKey.replace(/-----BEGIN[^-]*-----/g, '')
  cleanKey = cleanKey.replace(/-----END[^-]*-----/g, '')

  // 确保私钥内容不为空
  if (!cleanKey) {
    throw new Error('Private key content is empty after cleaning')
  }

  // 验证是否是有效的 Base64 字符
  if (!/^[A-Za-z0-9+/=]+$/.test(cleanKey)) {
    throw new Error('Private key contains invalid characters (not valid Base64)')
  }

  // 格式化为 64 字符一行
  const formattedKey = cleanKey.match(/.{1,64}/g)?.join('\n') || cleanKey

  return `-----BEGIN PRIVATE KEY-----\n${formattedKey}\n-----END PRIVATE KEY-----`
}

// ==================== 错误类 ====================

/**
 * Provider 创建错误
 * 当创建 provider 实例失败时抛出
 */
export class ProviderCreationError extends Error {
  constructor(
    message: string,
    public providerId: string,

View on GitHub (pinned to 726446b54c)

Solutions

1. If you have a service-account JSON, extract and pass only json.private_key.
2. Ensure the key is standard base64 (A–Z, a–z, 0–9, +, /, =).
3. Remove any non-base64 characters or re-export the key cleanly.

Example fix

// before — passing the whole JSON
formatPrivateKey(JSON.stringify(serviceAccountJson))
// after — pass only the private_key field
formatPrivateKey(serviceAccountJson.private_key)

const cleaned = privateKey.replace(/-----[^-]+-----/g, '').replace(/\s+/g, '')
if (!/^[A-Za-z0-9+/=]+$/.test(cleaned)) throw new Error('private key contains non-base64 chars (did you pass the whole JSON?)')
formatPrivateKey(privateKey)

When it happens

Trigger: The cleaned key string contains characters outside base64 alphabet: JSON braces/braces/colons, PEM armor fragments not caught by the marker regex, URL-encoded characters, or binary/garbage data.

Common situations: Passing the entire service-account JSON object stringified (with {, ", :) instead of just private_key; a key with embedded '-----BEGIN RSA PRIVATE KEY-----' (the BEGIN regex needs no '-' after BEGIN so 'RSA ' breaks it); URL-safe base64 using - and _; copy-paste with smart quotes.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Invalid PEM format: missing BEGIN/END markers or key content
• Private key content is empty after cleaning
• Private key must be a non-empty string
• Invalid token response from QQ API: ${errorText}
• Rerank response results must reference a valid document inde

AI-assisted analysis of CherryHQ/cherry-studio@726446b54c (2026-08-12). Data as JSON: /api/errors/76c1c7fd2c09c0a8. Report an issue: GitHub.