{"record":{"id":"07274faca5448f5b","repo":"ipfs/kubo","slug":"cannot-create-key-with-name-self-07274f","errorCode":null,"errorMessage":"cannot create key with name 'self'","messagePattern":"cannot create key with name 'self'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/coreapi/key.go","lineNumber":68,"sourceCode":"\n// ID returns key PeerID\nfunc (k *key) ID() peer.ID {\n\treturn k.peerID\n}\n\n// Generate generates new key, stores it in the keystore under the specified\n// name and returns a base58 encoded multihash of its public key.\nfunc (api *KeyAPI) Generate(ctx context.Context, name string, opts ...caopts.KeyGenerateOption) (coreiface.Key, error) {\n\t_, span := tracing.Span(ctx, \"CoreAPI.KeyAPI\", \"Generate\", trace.WithAttributes(attribute.String(\"name\", name)))\n\tdefer span.End()\n\n\toptions, err := caopts.KeyGenerateOptions(opts...)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif name == \"self\" {\n\t\treturn nil, errors.New(\"cannot create key with name 'self'\")\n\t}\n\n\t_, err = api.repo.Keystore().Get(name)\n\tif err == nil {\n\t\treturn nil, fmt.Errorf(\"key with name '%s' already exists\", name)\n\t}\n\n\tif err := caopts.CheckKeySize(options.Algorithm, options.Size); err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar sk crypto.PrivKey\n\tvar pk crypto.PubKey\n\n\tswitch options.Algorithm {\n\tcase \"rsa\":\n\t\tif options.Size == -1 {\n\t\t\toptions.Size = caopts.DefaultRSALen","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/coreapi/key.go#L50-L86","documentation":"'self' is a reserved key name that always refers to the node's identity key. The KeyAPI refuses to generate a new keystore key named 'self' because it would shadow the identity, so Generate returns this error before touching the keystore.","triggerScenarios":"Calling KeyAPI.Generate(ctx, \"self\") directly, or `ipfs key gen self ...` via the CLI.","commonSituations":"Scripting key creation from user-supplied names without filtering reserved names; attempting to re-create the identity key under its well-known alias.","solutions":["Choose a different key name; 'self' is already implicitly available.","Validate/whitelist user-supplied key names before calling Generate.","Use `ipfs key list` to see that 'self' exists and cannot be regenerated."],"exampleFix":"// before\nk, err := api.Key().Generate(ctx, name) // name == \"self\"\n// after\nif name == \"self\" {\n    return api.Key().Self(ctx)\n}\nk, err := api.Key().Generate(ctx, name)","handlingStrategy":"validation","validationCode":"if name == \"self\" {\n    return errors.New(\"'self' is reserved; use Key().Self() instead\")\n}\nif len(name) > 4096 || !utf8.ValidString(name) {\n    return errors.New(\"invalid key name\")\n}","typeGuard":"func isReservedKeyName(n string) bool { return n == \"self\" }","tryCatchPattern":"k, err := api.Key().Generate(ctx, name)\nif err != nil && strings.Contains(err.Error(), \"name 'self'\") {\n    k, err = api.Key().Self(ctx)\n}","preventionTips":["Whitelist or sanitize user-provided key names before Generate","Treat 'self' as an implicit alias, never a generatable name","Add a unit test asserting your name-validation rejects 'self'"],"tags":["keystore","keys","validation"],"backgroundTag":"reserved-key-name","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}