XTLS/Xray-core · error

parse config

Error message

parse config

What it means

Raised when the inbound-level `key` string fails standard base64 (StdEncoding) decoding during multi-user 2022 inbound construction. Shadowsocks-2022 keys must be base64-encoded raw bytes; any illegal character, bad padding, or URL-safe-base64 input (-/_ instead of +//) is rejected.

Source

Thrown at proxy/shadowsocks_2022/inbound_multi.go:76

			user.Email = "unnamed-user-" + strconv.Itoa(i) + "-" + u.String()
		}
		u, err := user.ToMemoryUser()
		if err != nil {
			return nil, errors.New("failed to get shadowsocks user").Base(err).AtError()
		}
		memUsers = append(memUsers, u)
	}

	inbound := &MultiUserInbound{
		networks: networks,
		users:    memUsers,
	}
	if config.Key == "" {
		return nil, errors.New("missing key")
	}
	psk, err := base64.StdEncoding.DecodeString(config.Key)
	if err != nil {
		return nil, errors.New("parse config").Base(err)
	}
	service, err := shadowaead_2022.NewMultiService[int](config.Method, psk, 500, inbound, nil)
	if err != nil {
		return nil, errors.New("create service").Base(err)
	}
	err = service.UpdateUsersWithPasswords(
		C.MapIndexed(memUsers, func(index int, it *protocol.MemoryUser) int { return index }),
		C.Map(memUsers, func(it *protocol.MemoryUser) string { return it.Account.(*MemoryAccount).Key }),
	)
	if err != nil {
		return nil, errors.New("create service").Base(err)
	}

	inbound.service = service
	return inbound, nil
}

// AddUser implements proxy.UserManager.AddUser().

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Regenerate the key with `openssl rand -base64 32` (or 16) and paste it as a single line.
2. If your source is urlsafe base64, re-encode to standard: translate -_ to +/ and fix padding.
3. Trim whitespace/newlines when scripting config generation.

Example fix

# before (urlsafe characters)
"key": "abc-def_ghi"
# after
"key": "$(openssl rand -base64 32 | tr -d '\n')"

func isStdBase64(s string) bool {
  _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))
  return err == nil
}

func isStdBase64(s string) bool { _, err := base64.StdEncoding.DecodeString(s); return err == nil }

psk, err := base64.StdEncoding.DecodeString(config.Key)
if err != nil {
  return fmt.Errorf("key must be standard base64 (no urlsafe chars/newlines): %w", err)
}

When it happens

Trigger: config.Key contains characters outside the standard base64 alphabet, incorrect '=' padding, or was encoded with urlsafe base64; also whitespace/newlines pasted from key generators.

Common situations: Copying keys that wrap across lines in terminals; keys generated by tools that emit urlsafe base64; stray quotes/spaces from manual editing.

Related errors

• create service
• missing key
• Invalid base64 string
• shadowsocks 2022 (multi-user): missing server method
• shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/4e746598a1a2cfee. Report an issue: GitHub.