{"record":{"id":"3a3b7b3c93c500ee","repo":"windmill-labs/windmill","slug":"no-encryption-key-found-skipping-encryption-reco","errorCode":null,"errorMessage":"No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY","messagePattern":"No encryption key found, skipping encryption\\. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/src/core/settings.ts","lineNumber":552,"sourceCode":"        );\n      } else if (s.name == \"oauths\") {\n        if (typeof s.value === \"object\") {\n          const oauths = s.value as { [key: string]: any };\n          for (const [k, v] of Object.entries(oauths)) {\n            oauths[k] = await processField(v, \"secret\", encKey, mode);\n          }\n          res.push(s);\n        } else {\n          log.warn(`Unexpected oauths value type: ${typeof s.value}`);\n          res.push(s);\n        }\n      } else {\n        res.push(s);\n      }\n    }\n    return res;\n  } else {\n    log.warn(\n      \"No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY\"\n    );\n  }\n  return settings;\n}\n\nasync function processField(\n  obj: { [key: string]: any },\n  field: string,\n  encKey: string,\n  mode: \"encode\" | \"decode\"\n): Promise<{ [key: string]: any }> {\n  return {\n    ...obj,\n    [field]:\n      mode === \"encode\"\n        ? await encrypt(obj[field], encKey)\n        : ((await decrypt(obj[field], encKey)) as any),","sourceCodeStart":534,"sourceCodeEnd":570,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/core/settings.ts#L534-L570","documentation":"processInstanceSettings only encrypts/decrypts sensitive settings (license_key, jwt_secret, oauth secrets) when the WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY environment variable is set. When it is absent, encryption is skipped entirely: settings are written/pushed/read as-is and this warning is printed. This is dangerous on push because secrets would be stored or sent in plaintext, and on pull because encrypted remote values cannot be decrypted.","triggerScenarios":"Any call to processInstanceSettings (via pullInstanceSettings or pushInstanceSettings) in a shell where the WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY environment variable is unset or empty.","commonSituations":"Running `wmill settings push` in CI without exporting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY; running the CLI in a fresh terminal where only WMILL_TOKEN/WMILL_REMOTE are set; forgetting the key after moving to a new machine.","solutions":["Export the key before running the command: export WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY=<key> (the same key the instance uses).","Store the key in CI secrets and inject it into the environment for sync jobs.","Verify it is visible to the CLI process (printenv WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY) — shell rc files may not run in non-interactive shells.","Re-run `wmill settings pull` after setting the key so local files hold properly encrypted values."],"exampleFix":"// before\nwmill settings push\n// Warning: No encryption key found, skipping encryption...\n\n// after\nexport WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY=\"$(op read op://vault/wmill/enc-key)\"\nwmill settings push","handlingStrategy":"validation","validationCode":"if (!process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY) {\n  throw new Error(\"WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY must be set before wmill settings pull/push\");\n}","typeGuard":null,"tryCatchPattern":"const key = process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;\nif (!key) {\n  console.error(\"refusing to sync instance settings without WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY (secrets would be plaintext)\");\n  process.exit(1);\n}","preventionTips":["Set WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY in every environment (shell rc, CI secrets, container env) that runs settings sync","Treat the warning as a hard stop in CI: fail the job if the key is absent","Never push instance settings with encryption skipped — license_key and jwt_secret would go plaintext","Use the same key value the Windmill instance uses"],"tags":["cli","encryption","environment-variable","secrets","security"],"backgroundTag":"missing-env-var","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}