{"record":{"id":"3d369b0f3b078989","repo":"elsa-workflows/elsa-core","slug":"elsa-secrets-encryption-key-is-not-configured-configure","errorCode":null,"errorMessage":"Elsa Secrets encryption key is not configured. Configure SecretsOptions.EncryptionKey before using the encrypted secrets store.","messagePattern":"Elsa Secrets encryption key is not configured\\. Configure SecretsOptions\\.EncryptionKey before using the encrypted secrets store\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"critical","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretValueProtector.cs","lineNumber":45,"sourceCode":"        if (parts.Length != 4 || parts[0] != \"v1\")\n            throw new InvalidOperationException(\"The protected secret payload is not supported.\");\n\n        var nonce = Convert.FromBase64String(parts[1]);\n        var tag = Convert.FromBase64String(parts[2]);\n        var ciphertext = Convert.FromBase64String(parts[3]);\n        var plaintext = new byte[ciphertext.Length];\n\n        using var aes = new AesGcm(GetKey(), TagSize);\n        aes.Decrypt(nonce, ciphertext, tag, plaintext);\n\n        return System.Text.Encoding.UTF8.GetString(plaintext);\n    }\n\n    private byte[] GetKey()\n    {\n        var key = options.Value.EncryptionKey;\n        if (key == null || key.Length == 0)\n            throw new InvalidOperationException(\"Elsa Secrets encryption key is not configured. Configure SecretsOptions.EncryptionKey before using the encrypted secrets store.\");\n\n        if (key.Length is not (16 or 24 or 32))\n            throw new InvalidOperationException(\"Elsa Secrets encryption key must be exactly 16, 24, or 32 bytes.\");\n\n        return key;\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":53,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretValueProtector.cs#L27-L53","documentation":"GetKey reads SecretsOptions.EncryptionKey and throws InvalidOperationException when it is null or empty. The AES-GCM protector cannot encrypt or decrypt without a key, so the library fails fast instead of silently using an insecure default. Message explicitly names the option to configure.","triggerScenarios":"Any Protect/Unprotect call (encrypted secret store reads/writes, HmacExternalAuthenticationHandleHasher) when SecretsOptions.EncryptionKey was not set in DI configuration.","commonSituations":"Forgetting to bind SecretsOptions in Program.cs; key provided via env var not mapped to options; Developer/Production config sections missing; new deployment without the key in secret management.","solutions":["Configure SecretsOptions.EncryptionKey (16/24/32 bytes) at startup, e.g. services.Configure<SecretsOptions>(o => o.EncryptionKey = key).","Bind the key from configuration or environment (e.g. base64-decode ELISA_SECRETS_KEY) into options.","Add the key to the deployment's secret store (Azure Key Vault, Kubernetes secret, user-secrets in dev).","Add a startup validation check so the app fails fast with a clear message when the key is absent."],"exampleFix":"// before\nbuilder.Services.AddSecrets(); // EncryptionKey never set\n// after\nvar key = Convert.FromBase64String(builder.Configuration[\"Elsa:Secrets:EncryptionKey\"]!);\nbuilder.Services.Configure<SecretsOptions>(o => o.EncryptionKey = key); // 16/24/32 bytes","handlingStrategy":"validation","validationCode":"var key = configuration[\"Elsa:Secrets:EncryptionKey\"];\nif (string.IsNullOrWhiteSpace(key))\n    throw new InvalidOperationException(\"Set Elsa:Secrets:EncryptionKey (base64, 16/24/32 bytes) before using encrypted secrets.\");\nservices.Configure<SecretsOptions>(o => o.EncryptionKey = Convert.FromBase64String(key));","typeGuard":"bool KeyConfigured(SecretsOptions o) => o.EncryptionKey is { Length: > 0 };","tryCatchPattern":"try { var value = protector.Unprotect(stored); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"encryption key is not configured\"))\n{ logger.LogCritical(\"Secrets encryption key missing; check deployment configuration\"); throw; }","preventionTips":["Validate options at startup with IValidateOptions/ValidateOnStart","Store the key in the platform secret manager (Key Vault/K8s secret/user-secrets)","Map env vars into SecretsOptions explicitly","Add the key to deployment checklists"],"tags":["secrets","encryption","missing-config"],"backgroundTag":"missing-required-config-field","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}