{"record":{"id":"4180cf66f3a51679","repo":"phacility/phabricator","slug":"failed-to-load-credential-s","errorCode":null,"errorMessage":"Failed to load credential \"%s\"!","messagePattern":"Failed to load credential \"(.+?)\"!","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/passphrase/keys/PassphraseAbstractKey.php","lineNumber":25,"sourceCode":"  protected function requireCredential() {\n    if (!$this->credential) {\n      throw new Exception(pht('Credential is required!'));\n    }\n    return $this->credential;\n  }\n\n  private function loadCredential(\n    $phid,\n    PhabricatorUser $viewer) {\n\n    $credential = id(new PassphraseCredentialQuery())\n      ->setViewer($viewer)\n      ->withPHIDs(array($phid))\n      ->needSecrets(true)\n      ->executeOne();\n\n    if (!$credential) {\n      throw new Exception(pht('Failed to load credential \"%s\"!', $phid));\n    }\n\n    return $credential;\n  }\n\n  private function validateCredential(\n    PassphraseCredential $credential,\n    $provides_type) {\n\n    $type = $credential->getImplementation();\n\n    if (!$type) {\n      throw new Exception(\n        pht(\n          'Credential \"%s\" is of unknown type \"%s\"!',\n          $credential->getMonogram(),\n          $credential->getCredentialType()));\n    }","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/passphrase/keys/PassphraseAbstractKey.php#L7-L43","documentation":"Thrown by PassphraseAbstractKey::loadCredential() when a PassphraseCredentialQuery (with needSecrets(true)) for the given PHID returns no result. The query silently collapses three distinct situations into null: the PHID is not a credential at all, the credential row was deleted, or the acting viewer lacks the view policy to see it. The generic 'Failed to load credential' message therefore hides which of the three applies.","triggerScenarios":"Calling PassphraseSSHKey::loadFromPHID()/loadAndValidateFromPHID() with a PHID that is malformed or belongs to another object type; referencing a deleted credential (e.g. from a Drydock blueprint or repository config); running under a daemon/system actor whose policies exclude the credential.","commonSituations":"Stale credential PHIDs persisted in blueprints, build plans, or working copy configurations after the credential was deleted; passing 'PHID-USER-...' or an object name like 'K123' where a PHID string is expected; daemons running as omnipotent-less actors.","solutions":["Verify the PHID shape first: phid_get_type($phid) must return 'KREA' (credential).","Load the credential yourself with PassphraseCredentialQuery as the same viewer to distinguish 'not found' from 'no permission'.","Update whatever object references the PHID (blueprint, repository, build plan) to point at a live credential.","If policies are the cause, widen the credential's view policy or run the operation as an empowered actor."],"exampleFix":"// before\n$key = PassphraseSSHKey::loadFromPHID($phid, $viewer);\n\n// after\nif (!phid_get_type($phid) || phid_get_type($phid) != 'KREA') {\n  throw new Exception(\n    pht('Expected a credential PHID, got \"%s\".', $phid));\n}\n$exists = id(new PassphraseCredentialQuery())\n  ->setViewer($viewer)\n  ->withPHIDs(array($phid))\n  ->setLimit(1)\n  ->execute();\nif (!$exists) {\n  throw new Exception(\n    pht(\n      'Credential \"%s\" does not exist or is not visible to %s.',\n      $phid,\n      $viewer->getUsername()));\n}\n$key = PassphraseSSHKey::loadFromPHID($phid, $viewer);","handlingStrategy":"validation","validationCode":"if (!phid_get_type($phid) || phid_get_type($phid) != 'KREA') {\n  throw new Exception(pht('Expected a credential PHID, got \"%s\".', $phid));\n}\n$credential = id(new PassphraseCredentialQuery())\n  ->setViewer($viewer)\n  ->withPHIDs(array($phid))\n  ->setLimit(1)\n  ->execute();\nif (!$credential) {\n  // distinguish deleted vs policy-blocked before proceeding\n}","typeGuard":"function is_credential_phid($phid) {\n  return is_string($phid) && phid_get_type($phid) === 'KREA';\n}","tryCatchPattern":"try {\n  $key = PassphraseSSHKey::loadFromPHID($phid, $viewer);\n} catch (Exception $ex) {\n  // re-check with an omnipotent query to tell 'deleted' from 'no access'\n}","preventionTips":["Validate PHID shape (type KREA) before any credential-consuming API call.","When users delete credentials, scan blueprints/repos/build plans for dangling references.","Run daemons with an actor whose policies can see the credentials they must use."],"tags":["phabricator","passphrase","credentials","phid","policy"],"backgroundTag":"credential-not-found","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}