{"record":{"id":"9960609ee1d3356b","repo":"transloadit/uppy","slug":"invalid-encrypted-value-maybe-it-was-generated-wi","errorCode":null,"errorMessage":"Invalid encrypted value. Maybe it was generated with an old Companion version?","messagePattern":"Invalid encrypted value\\. Maybe it was generated with an old Companion version\\?","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@uppy/companion/src/server/helpers/utils.ts","lineNumber":136,"sourceCode":"export const decrypt = (encrypted: string, secret: string | Buffer): string => {\n  const nonceHexLength = nonceLength * 2 // because hex encoding uses 2 bytes per byte\n  // NOTE: The first 32 characters are the nonce, in hex format.\n  const nonce = Buffer.from(encrypted.slice(0, nonceHexLength), 'hex')\n  // The rest is the encrypted string, in base64url format.\n  const encryptionWithoutNonce = Buffer.from(\n    encrypted.slice(nonceHexLength),\n    'base64url',\n  )\n  // The last 16 bytes of the rest is the authentication tag\n  const authTag = encryptionWithoutNonce.subarray(-authTagLength)\n  // and the rest (from beginning) is the encrypted data\n  const encryptionWithoutNonceAndTag = encryptionWithoutNonce.subarray(\n    0,\n    -authTagLength,\n  )\n\n  if (nonce.length < nonceLength) {\n    throw new Error(\n      'Invalid encrypted value. Maybe it was generated with an old Companion version?',\n    )\n  }\n\n  const { key, iv } = createSecrets(secret, nonce)\n\n  const decipher = crypto.createDecipheriv('aes-256-ccm', key, iv, {\n    authTagLength,\n  })\n  decipher.setAuthTag(authTag)\n\n  const decrypted = Buffer.concat([\n    decipher.update(encryptionWithoutNonceAndTag),\n    decipher.final(),\n  ])\n  return decrypted.toString('utf8')\n}\n","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/transloadit/uppy/blob/5d4dedd02a1ac0ae022c75c54aca76558f88e256/packages/@uppy/companion/src/server/helpers/utils.ts#L118-L154","documentation":"Companion encrypts provider OAuth tokens before storing them in its database using AES-GCM with a key derived from COMPANION_SECRET. During decryption, the stored value is split into nonce and ciphertext; if the nonce is shorter than the required 12 bytes, the payload's structure doesn't match the expected format, and this error is thrown suggesting it came from an older Companion version.","triggerScenarios":"Running a newer Companion against a database (or Redis/SQLite session store) containing tokens encrypted by an older Companion with a different encoding, or after changing COMPANION_SECRET so the old value no longer decrypts to a parseable structure.","commonSituations":"Upgrading Companion across major versions while keeping the old token store; changing or re-generating COMPANION_SECRET; restoring a database backup from an incompatible version.","solutions":["Most likely: clear the stale token store (drop the companion.tokens table / flush the relevant storage) so users simply re-authenticate","Keep COMPANION_SECRET stable across deployments — verify it wasn't rotated accidentally","If upgrading from a very old Companion, follow the release notes migration path or wipe persisted tokens as part of the upgrade","Re-authenticate the affected providers after clearing tokens"],"exampleFix":"# before\nCOMPANION_SECRET=new-secret uppy-companion  # old tokens now fail to decrypt\n\n# after\n# wipe stored tokens once, then restart with a stable secret\nredis-cli --scan --pattern 'companion:*' | xargs redis-cli del\nCOMPANION_SECRET=new-secret uppy-companion","handlingStrategy":"fallback","validationCode":"// Assert expected secret/token-store compatibility at startup\nif (!process.env.COMPANION_SECRET || process.env.COMPANION_SECRET.length < 16) {\n  throw new Error('COMPANION_SECRET must be set and stable')\n}","typeGuard":"function isLegacyEncryptionError(err: unknown): boolean {\n  return err instanceof Error && err.message.includes('Invalid encrypted value')\n}","tryCatchPattern":"try {\n  const token = await companion.tokenStore.get(id)\n} catch (err) {\n  if (isLegacyEncryptionError(err)) {\n    await companion.tokenStore.delete(id) // force re-auth\n    return null\n  }\n  throw err\n}","preventionTips":["Keep COMPANION_SECRET identical across environments and deploys","When upgrading Companion, plan a token-store wipe / re-auth window","Back up both the secret and the token store together"],"tags":["companion","encryption","auth-token","migration"],"backgroundTag":"encryption-key-mismatch","analyzedSha":"5d4dedd02a1ac0ae022c75c54aca76558f88e256","analyzedAt":"2026-08-28T12:18:41.267Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}