{"record":{"id":"89587867abb1d881","repo":"ipfs/kubo","slug":"failed-to-decode-privkey-w","errorCode":null,"errorMessage":"failed to decode PrivKey: %w","messagePattern":"failed to decode PrivKey: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/config.go","lineNumber":639,"sourceCode":"\treturn cmd.Run()\n}\n\n// nodePeerID derives the PeerID implied by the private key stored in the repo\n// config. Identity.PeerID must equal this value; the node refuses to start\n// when the two disagree.\nfunc nodePeerID(r repo.Repo) (peer.ID, error) {\n\tkeyF, err := getConfig(r, config.PrivKeySelector)\n\tif err != nil {\n\t\treturn \"\", errors.New(\"failed to get PrivKey\")\n\t}\n\tpkstr, ok := keyF.Value.(string)\n\tif !ok {\n\t\treturn \"\", errors.New(\"private key in config was not a string\")\n\t}\n\tident := config.Identity{PrivKey: pkstr}\n\tpk, err := ident.DecodePrivateKey(\"\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to decode PrivKey: %w\", err)\n\t}\n\tid, err := peer.IDFromPrivateKey(pk)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to derive PeerID from PrivKey: %w\", err)\n\t}\n\treturn id, nil\n}\n\nfunc replaceConfig(r repo.Repo, file io.Reader) error {\n\tvar newCfg config.Config\n\tif err := json.NewDecoder(file).Decode(&newCfg); err != nil {\n\t\treturn errors.New(\"failed to decode file as config\")\n\t}\n\n\t// Handle Identity.PrivKey (secret)\n\n\tif len(newCfg.Identity.PrivKey) != 0 {\n\t\treturn errors.New(\"setting private key with API is not supported\")","sourceCodeStart":621,"sourceCodeEnd":657,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/config.go#L621-L657","documentation":"nodePeerID decodes the base64 Identity.PrivKey string via config.Identity.DecodePrivateKey. This error wraps that decode failure: the string is present and a string, but not valid base64 protobuf-encoded private key bytes (or of an unsupported key type).","triggerScenarios":"PrivKey truncated or modified during copy/paste into config; key in the wrong format (raw PEM, hex, JSON-encoded libp2p key) instead of the base64 protobuf form kubo expects; whitespace/newlines injected by editors or scripts.","commonSituations":"Users moving configs between machines who hand-mangle the key; attempts to paste a key exported from another tool (openssl PEM, ssh key) directly into Identity.PrivKey; sed/regex edits corrupting the base64 payload.","solutions":["Restore the original PrivKey from backup or regenerate: `ipfs init` in a fresh repo and copy the whole Identity block verbatim","Use `ipfs key export <name>` to get the canonical base64 format and paste it exactly, without whitespace","Verify the string is valid base64: `echo <key> | base64 -d > /dev/null && echo ok`","Never convert PEM/ssh keys into Identity.PrivKey; only libp2p protobuf-encoded base64 keys are accepted"],"exampleFix":"// before: PEM in config\n\"PrivKey\": \"-----BEGIN PRIVATE KEY-----\\n...\"\n// after: base64 protobuf key as produced by kubo\n\"PrivKey\": \"CAESqA...==\"","handlingStrategy":"validation","validationCode":"key=$(jq -r '.Identity.PrivKey' \"$IPFS_PATH/config\"); echo -n \"$key\" | base64 -d >/dev/null 2>&1 && echo \"valid base64\" || echo \"PrivKey is not valid base64\"","typeGuard":null,"tryCatchPattern":"pk, err := ident.DecodePrivateKey(\"\")\nif err != nil {\n    return fmt.Errorf(\"Identity.PrivKey is corrupt or not a libp2p protobuf key: %w\", err)\n}","preventionTips":["Copy Identity.PrivKey byte-for-byte; avoid editors/scripts that wrap lines or alter encoding","Only use keys from `ipfs key export` or a kubo-generated config — never PEM/ssh/hex keys","Validate base64 before pasting: `echo <key> | base64 -d | head -c4 | xxd`","Keep a backup of the original config before any key manipulation"],"tags":["config","crypto","identity"],"backgroundTag":"privkey-decode-failed","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}