{"record":{"id":"49c11f8e78760350","repo":"windmill-labs/windmill","slug":"failed-to-get-workspace-encryption-key-err","errorCode":null,"errorMessage":"Failed to get workspace encryption key: ${err}","messagePattern":"Failed to get workspace encryption key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/core/settings.ts","lineNumber":455,"sourceCode":"  // When set it takes precedence over the prompt and the env var.\n  skipReencrypt?: boolean;\n}\n\nexport async function pushWorkspaceKey(\n  workspace: string,\n  _path: string,\n  key: string | undefined,\n  localKey: string,\n  opts?: PushWorkspaceKeyOptions\n) {\n  try {\n    key = await wmill\n      .getWorkspaceEncryptionKey({\n        workspace,\n      })\n      .then((r) => r.key);\n  } catch (err) {\n    throw new Error(`Failed to get workspace encryption key: ${err}`);\n  }\n  if (localKey && key !== localKey) {\n    // Changing the key on the remote means the existing ciphertexts (encrypted\n    // with the old key) become unreadable unless they are re-encrypted. By\n    // default we ask the backend to re-encrypt every secret variable with the\n    // new key, which preserves their plaintext values. The only reason to skip\n    // re-encryption is when the stored ciphertexts are *already* encrypted with\n    // the new key (e.g. a workspace/instance migration).\n    let reencrypt: boolean;\n    // Explicit choice via `--skip-reencrypt-on-key-change` or the env var wins\n    // over everything, regardless of interactivity.\n    const explicitSkip =\n      opts?.skipReencrypt ||\n      (process.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? \"\").toLowerCase() ===\n        \"true\";\n    if (explicitSkip) {\n      reencrypt = false;\n      log.info(","sourceCodeStart":437,"sourceCodeEnd":473,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/core/settings.ts#L437-L473","documentation":"pushWorkspaceKey wraps the remote GET of the workspace encryption key; if that call fails (permissions, network, server error) the key comparison with the local value cannot happen, so the error is re-raised with the cause.","triggerScenarios":"Thrown at cli/src/core/settings.ts:455 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the embedded error for 403 (admin rights required) vs network failure.","Retry after connectivity is restored.","Verify you are targeting the correct workspace."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}