{"record":{"id":"99a677c5ecc450a7","repo":"pulumi/pulumi","slug":"decoding-session-key-w","errorCode":null,"errorMessage":"decoding session key: %w","messagePattern":"decoding session key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/logs/share.go","lineNumber":264,"sourceCode":") (sessionID string, sessionKey []byte, err error) {\n\t// Resolve the cloud URL without requiring login — this endpoint needs no auth.\n\tcloudURL := httpstate.ValueOrDefaultURL(ws, \"\")\n\tif cloudURL == \"\" {\n\t\treturn \"\", nil, errors.New(\"could not determine Pulumi Cloud URL; set PULUMI_API or run `pulumi login`\")\n\t}\n\tinsecure := pkgWorkspace.GetCloudInsecure(ws, cloudURL)\n\n\tapiClient := client.NewClient(cloudURL, \"\" /*apiToken*/, insecure, cmdutil.Diag())\n\tresp, err := apiClient.CreateLogEncryptionSession(ctx, apitype.LogEncryptionSessionInitRequest{\n\t\tSessionKeyType: apitype.SessionKeyTypePlogV1,\n\t})\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"creating encryption session: %w\", err)\n\t}\n\n\tkeyBytes, err := base64.StdEncoding.DecodeString(resp.SessionKey)\n\tif err != nil {\n\t\treturn \"\", nil, fmt.Errorf(\"decoding session key: %w\", err)\n\t}\n\n\treturn resp.SessionID, keyBytes, nil\n}\n","sourceCodeStart":246,"sourceCodeEnd":269,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/logs/share.go#L246-L269","documentation":"After a successful session creation, the API returns the session key as a base64 string. This error wraps a failure of `base64.StdEncoding.DecodeString(resp.SessionKey)`, meaning the server returned a key that is not valid standard base64.","triggerScenarios":"CreateLogEncryptionSession returns a SessionID but its SessionKey string contains characters outside the standard base64 alphabet, is empty, or has invalid padding.","commonSituations":"Server/client version mismatch where the key is returned URL-safe encoded or with different padding; corrupted or mocked API response; backend bug.","solutions":["Upgrade the Pulumi CLI and backend so both use the same key encoding","Retry the command to get a fresh session","If persistent, report the backend returning malformed base64 (file an issue)"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// Go: validate base64 before use\nif _, err := base64.StdEncoding.DecodeString(resp.SessionKey); err != nil {\n    return fmt.Errorf(\"server returned malformed session key: %w\", err)\n}","typeGuard":"func validBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(s)\n    return err == nil && s != \"\"\n}","tryCatchPattern":"if err := shareLogs(...); err != nil {\n    if strings.Contains(err.Error(), \"decoding session key\") {\n        // CLI/server encoding mismatch: upgrade CLI and retry\n        return upgradeAndRetry()\n    }\n    return err\n}","preventionTips":["Keep CLI and backend versions aligned","Report persistent malformed-key responses upstream","Retry to obtain a fresh session key"],"tags":["encoding","api","base64"],"backgroundTag":"invalid-base64-payload","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}