{"record":{"id":"ecbc2a5d595f34a5","repo":"ipfs/kubo","slug":"cannot-set-identity-peerid-to-a-value-that-does-no","errorCode":null,"errorMessage":"cannot set Identity.PeerID to a value that does not match the node's private key; use 'ipfs key rotate' to change the node identity","messagePattern":"cannot set Identity\\.PeerID to a value that does not match the node's private key; use 'ipfs key rotate' to change the node identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/config.go","lineNumber":140,"sourceCode":"\t\t\t// PeerID in any standard form (base58 or CIDv1), compare decoded\n\t\t\t// IDs rather than strings, store the canonical base58 string kubo\n\t\t\t// writes elsewhere, and point a mismatched value at the supported\n\t\t\t// way to change the identity.\n\t\t\tif strings.EqualFold(key, \"identity.peerid\") {\n\t\t\t\tcandidate := value\n\t\t\t\tif parseJSON, _ := req.Options[configJSONOptionName].(bool); parseJSON {\n\t\t\t\t\tvar s string\n\t\t\t\t\tif err := json.Unmarshal([]byte(value), &s); err == nil {\n\t\t\t\t\t\tcandidate = s\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tid, err := nodePeerID(r)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\tgot, err := peer.Decode(candidate)\n\t\t\t\tif err != nil || got != id {\n\t\t\t\t\treturn errors.New(\"cannot set Identity.PeerID to a value that does not match the node's private key; use 'ipfs key rotate' to change the node identity\")\n\t\t\t\t}\n\t\t\t\toutput, err = setConfig(r, key, id.String())\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\treturn cmds.EmitOnce(res, output)\n\t\t\t}\n\n\t\t\tif parseJSON, _ := req.Options[configJSONOptionName].(bool); parseJSON {\n\t\t\t\tvar jsonVal any\n\t\t\t\tif err := json.Unmarshal([]byte(value), &jsonVal); err != nil {\n\t\t\t\t\terr = fmt.Errorf(\"failed to unmarshal json. %s\", err)\n\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\toutput, err = setConfig(r, key, jsonVal)\n\t\t\t} else if isbool, _ := req.Options[configBoolOptionName].(bool); isbool {\n\t\t\t\toutput, err = setConfig(r, key, value == \"true\")","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/config.go#L122-L158","documentation":"`ipfs config Identity.PeerID <value>` validates that the given peer ID is a valid peer.Decode result AND equals the peer ID derived from the node's private key (nodePeerID(r)). Kubo throws this because Identity.PeerID is cryptographically bound to the PrivKey stored in the repo; setting an arbitrary value would produce a node whose advertised identity cannot be proven, so the write is refused.","triggerScenarios":"Running `ipfs config Identity.PeerID <id>` (or `--json`) with an ID that is not the node's own peer ID, a typo'd/copied peer ID, or an ID from another node; also a malformed peer ID string that fails peer.Decode (err != nil triggers the same branch).","commonSituations":"Migrating a config file between nodes by copy-pasting Identity sections; trying to 'claim' a peer ID without moving the corresponding private key; hand-editing config after `ipfs init` on a machine restored from backup where the key was regenerated.","solutions":["If you intend to change the node identity, run `ipfs key rotate` instead, which regenerates the keypair and updates Identity consistently","If you meant to keep the existing identity, leave Identity.PeerID alone; it is set automatically at `ipfs init`","If you are copying a config to another machine, copy the full repo (including the keystore/private key) or accept that the peer ID must change","Verify the correct value with `ipfs id` and use exactly that string if you must set it explicitly"],"exampleFix":"// before\n$ ipfs config Identity.PeerID 12D3KooWOtherNodeID\nerror: cannot set Identity.PeerID...\n// after\n$ ipfs key rotate --old-key-type=ed25519 # generates a new key + matching PeerID\n$ ipfs id -f '<id>'","handlingStrategy":"validation","validationCode":"id=$(ipfs id -f '<id>'); if [ \"$wanted\" != \"$id\" ]; then echo \"PeerID must be $id (or use 'ipfs key rotate')\"; exit 1; fi","typeGuard":"func isNodePeerID(cfg *config.Config, candidate string) bool {\n\tgot, err := peer.Decode(candidate)\n\treturn err == nil && got.Pretty() == cfg.Identity.PeerID\n}","tryCatchPattern":null,"preventionTips":["Never hand-edit Identity.PeerID; treat Identity as owned by `ipfs init`/`ipfs key rotate`","Copy whole repos (including keys) rather than individual config fields between nodes","Use `ipfs id` to get the authoritative peer ID before any script that references it"],"tags":["config","identity","cli","peerid"],"backgroundTag":"config-key-mismatch","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}