{"record":{"id":"23cdfd97f5c77a15","repo":"ipfs/kubo","slug":"private-key-in-config-does-not-match-id-s-s","errorCode":null,"errorMessage":"private key in config does not match id: %s != %s","messagePattern":"private key in config does not match id: (.+?) != (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/node/identity.go","lineNumber":25,"sourceCode":"\t\"github.com/libp2p/go-libp2p/core/peer\"\n)\n\nfunc PeerID(id peer.ID) func() peer.ID {\n\treturn func() peer.ID {\n\t\treturn id\n\t}\n}\n\n// PrivateKey loads the private key from config\nfunc PrivateKey(sk crypto.PrivKey) func(id peer.ID) (crypto.PrivKey, error) {\n\treturn func(id peer.ID) (crypto.PrivKey, error) {\n\t\tid2, err := peer.IDFromPrivateKey(sk)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif id2 != id {\n\t\t\treturn nil, fmt.Errorf(\"private key in config does not match id: %s != %s\", id, id2)\n\t\t}\n\t\treturn sk, nil\n\t}\n}\n","sourceCodeStart":7,"sourceCodeEnd":30,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/node/identity.go#L7-L30","documentation":"At node construction, Kubo derives the peer ID from the private key stored in the repo (Identity.PrivKey) and compares it with the PeerID configured/expected. If they differ, the identity is inconsistent and node construction aborts. This protects against a corrupted or mismatched repo where the key was replaced or the config PeerID field points to a different keypair.","triggerScenarios":"Starting the daemon when cfg.Identity.PrivKey decodes to a key whose peer.ID differs from the id passed in — e.g. Identity.Peering/identity fields edited by hand, key regenerated but stale references kept, or a repo copied with mismatched config.","commonSituations":"Hand-editing the config's PrivKey or copying an init'ed repo and editing fields; restoring partial backups; migrations or repo corruption; tooling that regenerated the key but kept old config.","solutions":["Back up then re-init the repo (`ipfs init`) to generate a consistent identity — note this changes your peer ID unless the key is preserved","If you have the original key, restore Identity.PrivKey so it matches the expected peer ID (verify: the base58 peer ID equals `ipfs id`'s output from when the repo was healthy)","Run `ipfs repo fsck` / check the datastore for corruption and re-import your pins from a known-good backup"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"sk, err := crypto.UnmarshalPrivateKey(privKeyBytes)\nif err != nil { return err }\nid2, err := peer.IDFromPrivateKey(sk)\nif err != nil { return err }\nif id2.String() != expectedPeerID {\n    return fmt.Errorf(\"config identity mismatch: key derives %s, expected %s\", id2, expectedPeerID)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit Identity.PrivKey or PeerID fields in the config","Back up $IPFS_PATH before migrations; restore identity and config together","After restoring a repo, run `ipfs id` and compare with the historical peer ID before serving traffic"],"tags":["identity","config","peerid"],"backgroundTag":"key-identity-mismatch","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}