{"record":{"id":"6c543583510f1d42","repo":"semaphoreui/semaphore","slug":"access-key-encryption-must-be-a-valid-base64-strin","errorCode":null,"errorMessage":"access_key_encryption must be a valid base64 string: %w","messagePattern":"access_key_encryption must be a valid base64 string: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/config.go","lineNumber":1735,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tvar enc EncryptionKeysConfig\n\tif err := json.Unmarshal(data, &enc); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &enc, nil\n}\n\nfunc validateAccessKeyEncryption(key string) error {\n\tif key == \"\" {\n\t\treturn nil\n\t}\n\n\tencryption, err := base64.StdEncoding.DecodeString(key)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"access_key_encryption must be a valid base64 string: %w\", err)\n\t}\n\n\tswitch len(encryption) {\n\tcase 16, 24, 32:\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\n\t\t\t\"access_key_encryption has invalid decoded length %d bytes; AES requires 16, 24, or 32 bytes (use `openssl rand -base64 32` to generate a valid key)\",\n\t\t\tlen(encryption),\n\t\t)\n\t}\n}\n\nfunc validateConfig() {\n\terr := validate(Config)\n\tif err != nil {\n\t\tpanic(err)\n\t}","sourceCodeStart":1717,"sourceCodeEnd":1753,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/config.go#L1717-L1753","documentation":"validateAccessKeyEncryption checks the access_key_encryption (or option_encryption) config value: it must be base64 that decodes into an AES key. This error is returned when base64.StdEncoding.DecodeString fails, meaning the configured value contains characters outside the base64 alphabet, wrong padding, or whitespace/quotes. It is surfaced as a startup panic via validateConfig.","triggerScenarios":"Config.AccessKeyEncryption or Config.OptionEncryption is non-empty and fails base64.StdEncoding.DecodeString in validateAccessKeyEncryption().","commonSituations":"Pasting a raw passphrase instead of a base64 key; shell added quotes when exporting the env var (SEMAPHORE_ACCESS_KEY_ENCRYPTION); value copied with trailing newline handled incorrectly (leading/trailing whitespace is actually accepted by StdEncoding? no — inner whitespace breaks it); generating a hex key instead of base64.","solutions":["Regenerate a proper base64 key with `openssl rand -base64 32` and set it exactly as printed.","Strip quotes and whitespace from the configured value (env vars often pick up surrounding quotes from .env files).","If the key was generated as hex (`openssl rand -hex 32`), re-encode: `openssl rand -hex 32 | xxd -r -p | base64`.","Confirm base64 validity first: `echo \"$ACCESS_KEY_ENCRYPTION\" | base64 -d > /dev/null && echo ok`."],"exampleFix":"// before\nexport SEMAPHORE_ACCESS_KEY_ENCRYPTION=\"my secret passphrase\"\n// after\nexport SEMAPHORE_ACCESS_KEY_ENCRYPTION=$(openssl rand -base64 32)","handlingStrategy":"validation","validationCode":"// Validate before deploying\nvalue := os.Getenv(\"SEMAPHORE_ACCESS_KEY_ENCRYPTION\")\nif value != \"\" {\n    if _, err := base64.StdEncoding.DecodeString(value); err != nil {\n        log.Fatalf(\"access_key_encryption is not valid base64: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"defer func() {\n    if r := recover(); r != nil {\n        log.Fatalf(\"invalid access_key_encryption: %v\", r)\n    }\n}()","preventionTips":["Always generate with `openssl rand -base64 32`.","Strip quotes when storing values in .env files or Helm values.","Add `echo -n \"$VAL\" | base64 -d >/dev/null` to pre-deploy smoke checks."],"tags":["config","base64","aes","validation","env"],"backgroundTag":"invalid-config-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}