{"record":{"id":"49e8f1cbb96d7c71","repo":"tursodatabase/turso","slug":"encryption-key-is-required-when-encryption-cipher","errorCode":null,"errorMessage":"Encryption Key is required when Encryption Cipher is specified.","messagePattern":"Encryption Key is required when Encryption Cipher is specified\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnection.cs","lineNumber":93,"sourceCode":"        if (_turso is not null || _remoteClient is not null)\n            throw new InvalidOperationException(\"The connection is already open.\");\n\n        if (_connectionOptions.IsRemote)\n        {\n            OpenRemote();\n            return;\n        }\n\n        ValidateLocalOnlyOptions();\n\n        var filename = _connectionOptions[\"Data Source\"] ?? \":memory:\";\n        var cipher = _connectionOptions.GetEncryptionCipher();\n        var hexkey = _connectionOptions[\"Encryption Key\"];\n\n        if (cipher.HasValue)\n        {\n            if (string.IsNullOrWhiteSpace(hexkey))\n                throw new InvalidOperationException(\"Encryption Key is required when Encryption Cipher is specified.\");\n\n            _turso = TursoBindings.OpenDatabaseWithEncryption(filename, cipher.Value, hexkey);\n        }\n        else\n        {\n            _turso = TursoBindings.OpenDatabase(filename);\n        }\n    }\n\n    public override Task OpenAsync(CancellationToken cancellationToken)\n    {\n        if (cancellationToken.IsCancellationRequested)\n            return Task.FromCanceled(cancellationToken);\n\n        if (_connectionOptions.IsReplica)\n            return OpenReplicaAsync(cancellationToken);\n\n        Open();","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/tursodatabase/turso/blob/6c7252267988c76e632af00a671e4b9788dfae13/bindings/dotnet/src/Turso.Data/TursoConnection.cs#L75-L111","documentation":"For local (non-URL) databases, Open() reads Encryption Cipher and Encryption Key from the connection string (TursoConnection.cs:70-78). A cipher without a key is rejected with InvalidOperationException because TursoBindings.OpenDatabaseWithEncryption needs the hex-encoded key material to open the encrypted database file.","triggerScenarios":"Connection string \"Data Source=file.db;Encryption Cipher=Aes256\" with no Encryption Key entry (or a whitespace one), on a local/embedded database.","commonSituations":"The key lives in a secret store/env var and was never merged into the connection string; connection-string transforms scrubbed the key for security; the cipher option was copied from docs while the key line was dropped.","solutions":["Add the hex key: \"Data Source=file.db;Encryption Cipher=Aes256;Encryption Key=<hex>\".","Compose the connection string at runtime, injecting the key from your secret store (env var / key vault) rather than hardcoding it.","If encryption is not intended, remove the Encryption Cipher option entirely so the plain OpenDatabase path is used."],"exampleFix":"// before\nvar cs = \"Data Source=app.db;Encryption Cipher=Aes256\"; // no key -> throws on Open\n\n// after\nvar cs = $\"Data Source=app.db;Encryption Cipher=Aes256;Encryption Key={Environment.GetEnvironmentVariable(\"TURSO_HEX_KEY\")}\";","handlingStrategy":"validation","validationCode":"var opts = TursoConnectionOptions.Parse(cs);\nvar cipher = opts.GetEncryptionCipher();\nvar key = opts[\"Encryption Key\"];\nif (cipher.HasValue && string.IsNullOrWhiteSpace(key))\n    throw new InvalidOperationException(\"Encryption Key missing for encrypted local database.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Compose the connection string at runtime and inject the key from a secret store.","Validate cipher/key pairing in startup checks before any connection is opened.","Name the key consistently (e.g. TURSO_HEX_KEY) across environments."],"tags":["dotnet","tursodb","encryption","connection-string","local-database"],"backgroundTag":"missing-encryption-key","analyzedSha":"6c7252267988c76e632af00a671e4b9788dfae13","analyzedAt":"2026-08-20T07:02:18.389Z","contentChangedAt":"2026-08-20T07:02:18.389Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}