{"record":{"id":"1aa9aa28dc9ab282","repo":"ipfs/kubo","slug":"cannot-show-or-change-private-key-through-api","errorCode":null,"errorMessage":"cannot show or change private key through API","messagePattern":"cannot show or change private key through API","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/config.go","lineNumber":93,"sourceCode":"\tArguments: []cmds.Argument{\n\t\tcmds.StringArg(\"key\", true, false, \"The key of the config entry (e.g. \\\"Addresses.API\\\").\"),\n\t\tcmds.StringArg(\"value\", false, false, \"The value to set the config entry to.\"),\n\t},\n\tOptions: []cmds.Option{\n\t\tcmds.BoolOption(configBoolOptionName, \"Set a boolean value.\"),\n\t\tcmds.BoolOption(configJSONOptionName, \"Parse stringified JSON.\"),\n\t\tcmds.BoolOption(configExpandAutoName, \"Expand 'auto' placeholders to their expanded values from AutoConf service.\"),\n\t},\n\tRun: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {\n\t\targs := req.Arguments\n\t\tkey := args[0]\n\n\t\tvar output *ConfigField\n\n\t\t// This is a temporary fix until we move the private key out of the config file\n\t\tswitch strings.ToLower(key) {\n\t\tcase \"identity\", \"identity.privkey\":\n\t\t\treturn errors.New(\"cannot show or change private key through API\")\n\t\tdefault:\n\t\t}\n\n\t\t// Temporary fix until we move ApiKey secrets out of the config file\n\t\t// (remote services are a map, so more advanced blocking is required)\n\t\tif blocked := matchesGlobPrefix(key, config.PinningConcealSelector); blocked {\n\t\t\treturn errors.New(\"cannot show or change pinning services credentials\")\n\t\t}\n\n\t\tcfgRoot, err := cmdenv.GetConfigRoot(env)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tr, err := fsrepo.Open(cfgRoot)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer r.Close()","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/config.go#L75-L111","documentation":"'ipfs config' guard block: the requested key is 'Identity' or 'Identity.PrivKey', the node's private key. Reading or writing the key over the RPC API is deliberately forbidden to prevent key exfiltration; use the filesystem and IPFS_PATH instead.","triggerScenarios":"Thrown at core/commands/config.go:93 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Edit the Identity fields directly in the config file on the machine running the node","Use 'ipfs key' commands for key management instead of raw config access"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}