{"record":{"id":"a5623ea047da0f10","repo":"FlowiseAI/Flowise","slug":"credentials-could-not-be-decrypted","errorCode":null,"errorMessage":"Credentials could not be decrypted.","messagePattern":"Credentials could not be decrypted\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/utils.ts","lineNumber":644,"sourceCode":"                decryptedDataStr = decryptedData.toString(enc.Utf8)\n            }\n        } catch (error) {\n            console.error(error)\n            throw new Error('Failed to decrypt credential data.')\n        }\n    } else {\n        // Fallback to existing code\n        const encryptKey = await getEncryptionKey()\n        const decryptedData = AES.decrypt(encryptedData, encryptKey)\n        decryptedDataStr = decryptedData.toString(enc.Utf8)\n    }\n\n    if (!decryptedDataStr) return {}\n    try {\n        return JSON.parse(decryptedDataStr)\n    } catch (e) {\n        console.error(e)\n        throw new Error('Credentials could not be decrypted.')\n    }\n}\n\n/**\n * Get credential data\n * @param {string} selectedCredentialId\n * @param {ICommonObject} options\n * @returns {Promise<ICommonObject>}\n */\nexport const getCredentialData = async (selectedCredentialId: string, options: ICommonObject): Promise<ICommonObject> => {\n    const appDataSource = options.appDataSource as DataSource\n    const databaseEntities = options.databaseEntities as IDatabaseEntity\n\n    try {\n        if (!selectedCredentialId) {\n            return {}\n        }\n","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/utils.ts#L626-L662","documentation":"Thrown after decryption when the resulting decryptedDataStr cannot be JSON.parsed. This means the AES/Secrets-Manager decryption produced a string that is not a valid JSON object — typically because the encryption key is wrong, the payload is corrupted, or the stored value was never JSON to begin with.","triggerScenarios":"decryptedData.toString(enc.Utf8) yields garbage (wrong key → crypto-js returns empty or mojibake); the encrypted blob was truncated/corrupted in the DB; the credential was originally stored as a plain string rather than JSON.stringify(obj); a DB migration altered the column charset and mangled the ciphertext.","commonSituations":"FLOWISE_ENCRYPTION_KEY changed without re-encrypting existing credentials; restoring a DB backup from an instance that used a different encryption key; crypto-js AES returning an empty WordArray that becomes '' (then toString gives '' and JSON.parse('') throws); SQLite/Postgres column encoding changes corrupting base64-style ciphertext.","solutions":["Confirm FLOWISE_ENCRYPTION_KEY (or the key file at getEncryptionKeyPath()) is identical to the key used when the credential was saved.","Re-create the affected credential through the Flowise UI so it is encrypted with the current key.","Log decryptedDataStr (redacted) length to detect empty/garbage output — length 0 indicates a key mismatch.","If migrating keys, write a one-time migration that decrypts with the old key and re-encrypts with the new one."],"exampleFix":"// before\nif (!decryptedDataStr) return {}\ntry {\n  return JSON.parse(decryptedDataStr)\n} catch (e) {\n  console.error(e)\n  throw new Error('Credentials could not be decrypted.')\n}\n\n// after — distinguish empty vs malformed and surface the parse error\nif (!decryptedDataStr) return {}\ntry {\n  return JSON.parse(decryptedDataStr)\n} catch (e) {\n  throw new Error(\n    `Credentials could not be decrypted: decrypted payload is not valid JSON (len=${decryptedDataStr.length}). Likely an encryption-key mismatch.`,\n    { cause: e }\n  )\n}","handlingStrategy":"validation","validationCode":"function looksLikeJson(s: string | undefined): boolean {\n  if (!s) return false\n  const t = s.trim()\n  return t.startsWith('{') || t.startsWith('[')\n}","typeGuard":"function isParsableCredentialJson(s: string): boolean {\n  try { JSON.parse(s); return true } catch { return false }\n}","tryCatchPattern":"try {\n  return JSON.parse(decryptedDataStr)\n} catch (e) {\n  throw new Error(`Credentials could not be decrypted (len=${decryptedDataStr.length}). Likely key mismatch.`, { cause: e })\n}","preventionTips":["Back up FLOWISE_ENCRYPTION_KEY before rotating it.","After any key change, run a re-encrypt migration for all stored credentials.","Log decryptedDataStr length (redacted) to detect empty/garbage output fast."],"tags":["credentials","encryption","json","config","key-mismatch"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}