{"record":{"id":"5e9b6ee19372118d","repo":"ipfs/kubo","slug":"cannot-show-or-change-pinning-services-credentials","errorCode":null,"errorMessage":"cannot show or change pinning services credentials","messagePattern":"cannot show or change pinning services credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/config.go","lineNumber":100,"sourceCode":"\t\tcmds.BoolOption(configExpandAutoName, \"Expand 'auto' placeholders to their expanded values from AutoConf service.\"),\n\t},\n\tRun: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {\n\t\targs := req.Arguments\n\t\tkey := args[0]\n\n\t\tvar output *ConfigField\n\n\t\t// This is a temporary fix until we move the private key out of the config file\n\t\tswitch strings.ToLower(key) {\n\t\tcase \"identity\", \"identity.privkey\":\n\t\t\treturn errors.New(\"cannot show or change private key through API\")\n\t\tdefault:\n\t\t}\n\n\t\t// Temporary fix until we move ApiKey secrets out of the config file\n\t\t// (remote services are a map, so more advanced blocking is required)\n\t\tif blocked := matchesGlobPrefix(key, config.PinningConcealSelector); blocked {\n\t\t\treturn errors.New(\"cannot show or change pinning services credentials\")\n\t\t}\n\n\t\tcfgRoot, err := cmdenv.GetConfigRoot(env)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tr, err := fsrepo.Open(cfgRoot)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer r.Close()\n\t\tif len(args) == 2 {\n\t\t\t// Check if user is trying to write config with expand flag\n\t\t\tif expandAuto, _ := req.Options[configExpandAutoName].(bool); expandAuto {\n\t\t\t\treturn fmt.Errorf(\"--expand-auto can only be used for reading config values, not for setting them\")\n\t\t\t}\n\n\t\t\tvalue := args[1]","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/config.go#L82-L118","documentation":"'ipfs config' guard block: the requested key matches the Pinning.RemoteServices conceal selector (glob prefix), which hides remote pinning service API credentials. They are secrets and cannot be read or changed through the API to avoid leaking access tokens.","triggerScenarios":"Thrown at core/commands/config.go:100 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Manage pinning service credentials via 'ipfs pin remote service' commands","Edit the Pinning.RemoteServices section directly in the config file on the host"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}