{"record":{"id":"8e19df8e25502b5d","repo":"semaphoreui/semaphore","slug":"invalid-access-token-type","errorCode":null,"errorMessage":"invalid access token type","messagePattern":"invalid access token type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"services/server/access_key_serializer_local.go","lineNumber":68,"sourceCode":"\t\t}\n\tcase db.AccessKeyLoginPassword:\n\t\tif key.LoginPassword.Password == \"\" {\n\t\t\tif key.LoginPassword.Login != \"\" {\n\t\t\t\treturn fmt.Errorf(\"invalid password key\")\n\t\t\t}\n\t\t\tkey.Secret = nil\n\t\t\treturn nil\n\t\t}\n\n\t\tplaintext, err = json.Marshal(key.LoginPassword)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\tcase db.AccessKeyNone:\n\t\tkey.Secret = nil\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"invalid access token type\")\n\t}\n\n\tsecret, err := util.Config.EncryptAccessSecret(plaintext)\n\tif err != nil {\n\t\treturn err\n\t}\n\tkey.Secret = &secret\n\n\treturn nil\n}\n\nfunc (d *LocalAccessKeyDeserializer) DeserializeSecret(key *db.AccessKey) (res string, err error) {\n\treturn d.deserialize(key, func(stored string) ([]byte, error) {\n\t\treturn util.Config.DecryptAccessSecret(stored)\n\t})\n}\n\n// DeserializeSecret2 decrypts using a single explicit key (stripping any key-id","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/services/server/access_key_serializer_local.go#L50-L86","documentation":"SerializeSecret switches on the access key's Type to decide what plaintext to encrypt. Recognized types are SSH, LoginPassword, and None (which stores no secret); any other Type value hits the default branch and returns 'invalid access token type'. The key carries a type enum value the serializer does not know.","triggerScenarios":"SerializeSecret (e.g. from RekeyAccessKeys) on an AccessKey whose db.AccessKey Type is an unrecognized value (corrupted enum, future/new type unknown to this binary, or 0/garbage value).","commonSituations":"Rows migrated from another install with unmapped type values; manual DB edits; running an older Semaphore binary against data written by a newer version with a new access key type.","solutions":["Set the access key's Type to a supported value: ssh, login_password, or none.","Upgrade Semaphore to a version that supports the key type present in the data.","Delete and recreate the affected access keys with a valid type via the API/UI."],"exampleFix":"// before\ntype: 7 // unknown\ntype: \"login_password\"","handlingStrategy":"validation","validationCode":"switch key.Type {\ncase db.AccessKeySSH, db.AccessKeyLoginPassword, db.AccessKeyNone:\n    // ok\ndefault:\n    // unsupported type: fix before SerializeSecret\n}","typeGuard":null,"tryCatchPattern":"if err := svc.SerializeSecret(key); err != nil && err.Error() == \"invalid access token type\" { /* recreate key with a supported type */ }","preventionTips":["Only use documented access key type enum values.","Keep the Semaphore binary version in sync with data written by newer versions.","Avoid manual edits to the access_keys table."],"tags":["go","enum","validation","access-keys"],"backgroundTag":"invalid-enum-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}