{"record":{"id":"72aec55f4cab1f3b","repo":"ipfs/kubo","slug":"key-type-t-is-not-allowed-to-be-imported-only-rs","errorCode":null,"errorMessage":"key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1; use flag --allow-any-key-type if you are sure of what you're doing","messagePattern":"key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1; use flag --allow-any-key-type if you are sure of what you're doing","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":536,"sourceCode":"\t\t\t\tif pemBlock != nil {\n\t\t\t\t\treturn fmt.Errorf(\"unexpected PEM block for format=%s: try again with format=%s\", keyFormatLibp2pCleartextOption, keyFormatPemCleartextOption)\n\t\t\t\t}\n\t\t\t\treturn fmt.Errorf(\"unable to unmarshall format=%s: %w\", keyFormatLibp2pCleartextOption, err)\n\t\t\t}\n\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unrecognized import format: %s\", importFormat)\n\t\t}\n\n\t\t// We only allow importing keys of the same type we generate (see list in\n\t\t// https://github.com/ipfs/interface-go-ipfs-core/blob/1c3d8fc/options/key.go#L58-L60),\n\t\t// unless explicitly stated by the user.\n\t\tallowAnyKeyType, _ := req.Options[keyAllowAnyTypeOptionName].(bool)\n\t\tif !allowAnyKeyType {\n\t\t\tswitch t := sk.(type) {\n\t\t\tcase *crypto.RsaPrivateKey, *crypto.Ed25519PrivateKey, *crypto.Secp256k1PrivateKey:\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1;\"+\n\t\t\t\t\t\" use flag --%s if you are sure of what you're doing\",\n\t\t\t\t\tt, keyAllowAnyTypeOptionName)\n\t\t\t}\n\t\t}\n\n\t\tcfgRoot, err := cmdenv.GetConfigRoot(env)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tr, err := fsrepo.Open(cfgRoot)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer r.Close()\n\n\t\t_, err = r.Keystore().Get(name)\n\t\tif err == nil {","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L518-L554","documentation":"The imported key parsed fine, but its type is not one kubo allows by default (RSA, Ed25519, Secp256k1) — matching the key types ipfs can generate. Importing other types (e.g. ECDSA) is blocked unless `--allow-any-key-type` is passed explicitly, because such keys cannot be generated by kubo and may behave unexpectedly with IPNS.","triggerScenarios":"`ipfs key import name -f pem-pkcs8-cleartext` with an ECDSA (or other exotic) PKCS8 key, without `--allow-any-key-type`. Note: if KeyPairFromStdKey cannot convert the type at all you hit error 342 first; this fires for types that convert but are not whitelisted.","commonSituations":"Importing openssl EC keys or keys from other crypto stacks; automation importing pre-generated corporate keys of unsupported algorithms.","solutions":["If you are sure, add the flag: `ipfs key import name -f pem-pkcs8-cleartext --allow-any-key-type key.pem`","Otherwise regenerate the key as Ed25519 (`openssl genpkey -algorithm ED25519`) or RSA and re-import","Check the key algorithm with `openssl pkey -in key.pem -noout -text` to confirm which type you have"],"exampleFix":"// before\n$ ipfs key import mykey -f pem-pkcs8-cleartext ecdsa.pem\nError: key type *crypto.EcdsaPrivateKey is not allowed...\n// after (intentional import)\n$ ipfs key import mykey -f pem-pkcs8-cleartext --allow-any-key-type ecdsa.pem\n// or replace with a supported key\n$ openssl genpkey -algorithm ED25519 -out key.pem","handlingStrategy":"validation","validationCode":"txt, _ := exec.Command(\"openssl\", \"pkey\", \"-in\", keyFile, \"-noout\", \"-text\").Output()\nallowed := bytes.Contains(txt, []byte(\"ED25519\")) || bytes.Contains(txt, []byte(\"Private-Key: (\"))\nif !allowed && !allowAnyType {\n    return fmt.Errorf(\"key algorithm not in {RSA, Ed25519, Secp256k1}; pass --allow-any-key-type or regenerate\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist key algorithms before importing in automation","Prefer generating keys with `ipfs key gen` to stay within supported types","Use --allow-any-key-type only for deliberate one-off migrations"],"tags":["keystore","key-type","validation","key-import"],"backgroundTag":"unsupported-key-type","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}