{"record":{"id":"96cb88c83b16eee6","repo":"ipfs/kubo","slug":"cannot-remove-key-with-name-self","errorCode":null,"errorMessage":"cannot remove key with name 'self'","messagePattern":"cannot remove key with name 'self'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/coreapi/key.go","lineNumber":250,"sourceCode":"\n\terr = ks.Delete(oldName)\n\tif err != nil {\n\t\treturn nil, false, err\n\t}\n\n\tk, err := newKey(newName, pid)\n\treturn k, overwrite, err\n}\n\n// Remove removes keys from keystore. Returns ipns path of the removed key.\nfunc (api *KeyAPI) Remove(ctx context.Context, name string) (coreiface.Key, error) {\n\t_, span := tracing.Span(ctx, \"CoreAPI.KeyAPI\", \"Remove\", trace.WithAttributes(attribute.String(\"name\", name)))\n\tdefer span.End()\n\n\tks := api.repo.Keystore()\n\n\tif name == \"self\" {\n\t\treturn nil, errors.New(\"cannot remove key with name 'self'\")\n\t}\n\n\tremoved, err := ks.Get(name)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"no key named %s was found\", name)\n\t}\n\n\tpubKey := removed.GetPublic()\n\n\tpid, err := peer.IDFromPublicKey(pubKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\terr = ks.Delete(name)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/coreapi/key.go#L232-L268","documentation":"The KeyAPI.Remove call refuses to delete the 'self' key, which holds the node's identity private key. The 'self' key is fundamental to the node's peer identity, libp2p identity, and IPNS publishing, so removing it would corrupt the node. The API deliberately blocks it with this sentinel error.","triggerScenarios":"Calling KeyAPI.Remove(ctx, \"self\"), e.g. via `ipfs key rm self`.","commonSituations":"Scripts that iterate over `ipfs key list` output and delete every listed key; users who want to rotate their node identity and try deleting 'self' first.","solutions":["Skip the 'self' key when deleting keys programmatically (filter it out of the list).","To change the node identity, generate a new one by removing the PeerID/private key from the repo (or re-init the repo), not by calling key rm.","If you truly need a disposable identity, create a separate key with `ipfs key gen` instead."],"exampleFix":"// before\nfor _, k := range keys { api.Key().Remove(ctx, k.Name) }\n// after\nfor _, k := range keys {\n    if k.Name != \"self\" {\n        api.Key().Remove(ctx, k.Name)\n    }\n}","handlingStrategy":"validation","validationCode":"if name == \"self\" {\n    return fmt.Errorf(\"refusing to remove the 'self' identity key\")\n}\nerr := api.Key().Remove(ctx, name)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never include \"self\" in programmatic key-deletion lists.","Treat the 'self' key as immutable infrastructure, not user data.","Rotate identity by re-initializing the repo, not by deleting keys."],"tags":["keystore","ipfs","identity"],"backgroundTag":"protected-key-deletion","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}