{"record":{"id":"eaea14676987a13a","repo":"atuinsh/atuin","slug":"the-encryption-key-on-this-machine-does-not-match-the-data","errorCode":null,"errorMessage":"the encryption key on this machine does not match the data on the server. this usually means a new machine was set up without copying the existing key. to fix: run `atuin key` on a machine that already syncs correctly, then run `atuin store rekey <key>` on this machine with the value from the other machine","messagePattern":"the encryption key on this machine does not match the data on the server\\. this usually means a new machine was set up without copying the existing key\\. to fix: run `atuin key` on a machine that already syncs correctly, then run `atuin store rekey <key>` on this machine with the value from the other machine","errorType":"error_code","errorClass":"SyncError","httpStatus":null,"severity":"error","filePath":"crates/atuin-client/src/record/sync/mod.rs","lineNumber":83,"sourceCode":"    },\n\n    #[error(\"operational error: {msg:?}\")]\n    OperationalError {\n        msg: String,\n    },\n\n    #[error(\"a request to the sync server failed: {msg:?}\")]\n    RemoteRequestError {\n        msg: String,\n    },\n\n    #[error(\n        \"the encryption key on this machine does not match the data on the server. this usually \\\n         means a new machine was set up without copying the existing key. to fix: run `atuin key` \\\n         on a machine that already syncs correctly, then run `atuin store rekey <key>` on this \\\n         machine with the value from the other machine\"\n    )]\n    WrongKey,\n}\n\n#[derive(Debug, Error)]\npub(crate) enum PackfileDownloadError {\n    #[error(\"failed to load the packfile manifest: {0}\")]\n    PackManifest(#[from] ParsingError),\n\n    #[error(\"packfile download failed: {0}\")]\n    Api(eyre::Report),\n\n    #[error(transparent)]\n    Unpack(#[from] UnpackError),\n\n    #[error(\"failed to store the unpacked history: {0}\")]\n    Store(eyre::Report),\n}\n\nimpl PackfileDownloadError {","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/atuinsh/atuin/blob/c0c717ab04c881764bcad4b3d169a507e2432643/crates/atuin-client/src/record/sync/mod.rs#L65-L101","documentation":"`SyncError::WrongKey` (crates/atuin-client/src/record/sync/mod.rs:83) is thrown during record-store sync when the server holds records this machine cannot decrypt: the local encryption key differs from the key that encrypted the server's data. Atuin syncs end-to-end-encrypted records, so a mismatched key makes downloads undecryptable and uploads inconsistent with the remote history. The error deliberately carries the full remediation instructions in its message.","triggerScenarios":"Running `atuin sync` (or any record-store sync operation) from a machine whose `~/.local/share/atuin/key` was regenerated or never copied, while the sync server already contains records encrypted with the original key; setting up a new machine without `atuin key --machine` import of the existing key; re-running `atuin key` (or `atuin init`) which overwrites the key file.","commonSituations":"New laptop/desktop setup where the user created a fresh atuin key instead of copying it from an existing syncing machine; reinstalling the OS and letting `atuin init` generate a new key; accidentally deleting or regenerating the key file; syncing a second machine before importing the primary's key.","solutions":["On a machine that syncs correctly, run `atuin key` to print the existing key","On this machine, run `atuin store rekey <key>` with that value to adopt the correct key","If no original key exists anywhere (server data is unrecoverable), reset the server-side data and start a fresh encrypted history on this machine","Back up `~/.local/share/atuin/key` and restore it on new machines before the first `atuin sync` to prevent recurrence"],"exampleFix":"// before: new machine with a freshly generated key\n$ atuin sync\n// error: the encryption key on this machine does not match the data on the server...\n// after: import the key from the working machine, then sync\n$ atuin key            # on the old machine — copy the output\n$ atuin store rekey <key-from-old-machine>\n$ atuin sync","handlingStrategy":"try-catch","validationCode":"// Before syncing from a new machine, confirm the local key matches\n// an existing syncing machine's key:\nlet local_key = std::fs::read_to_string(\"~/.local/share/atuin/key\")?;\nlet trusted_key = prompt_user_for_key_from_working_machine();\nif local_key.trim() != trusted_key.trim() {\n    run(\"atuin store rekey\", &[trusted_key.trim()])?;\n}","typeGuard":"fn key_matches(local: &str, trusted: &str) -> bool {\n    !local.trim().is_empty() && local.trim() == trusted.trim()\n}","tryCatchPattern":"match atuin_sync().await {\n    Err(e) if e.to_string().contains(\"encryption key on this machine does not match\") => {\n        eprintln!(\"Key mismatch: run `atuin key` on the syncing machine, then `atuin store rekey <key>` here.\");\n        std::process::exit(1);\n    }\n    Err(e) => return Err(e),\n    Ok(()) => {},\n}","preventionTips":["On every new machine, copy ~/.local/share/atuin/key (or run `atuin store rekey`) BEFORE the first `atuin sync`","Never re-run `atuin init`/`atuin key` on a machine that already syncs; it can overwrite the key","Keep an offline backup of the key file — losing it makes server data undecryptable","Script machine setup to import the key from a secrets store rather than generating a fresh one"],"tags":["encryption","sync","config","key-mismatch"],"backgroundTag":"missing-credentials","analyzedSha":"c0c717ab04c881764bcad4b3d169a507e2432643","analyzedAt":"2026-09-12T07:40:01.341Z","contentChangedAt":"2026-09-12T07:40:01.341Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}