{"record":{"id":"f0f1418df04b60f2","repo":"jdx/mise","slug":"invalid-bootstrap-secret-name-name-use-ascii","errorCode":null,"errorMessage":"invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'","messagePattern":"invalid bootstrap secret name '(.+?)': use ASCII letters, digits, '\\.', '_' or '-'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/secrets.rs","lineNumber":427,"sourceCode":"        None if prompt => prompt_value(declaration).map_err(|error| error.to_string())?,\n        None => return Err(format!(\"{} ({})\", declaration.name, declaration.env)),\n    };\n    if value.is_empty() && !declaration.allow_empty {\n        return Err(format!(\n            \"{} ({}) must not be empty\",\n            declaration.name, declaration.env\n        ));\n    }\n    Ok(value)\n}\n\nfn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {\n    if name.is_empty()\n        || !name\n            .chars()\n            .all(|character| character.is_ascii_alphanumeric() || \"_.-\".contains(character))\n    {\n        bail!(\"invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'\");\n    }\n    let (env, description, allow_empty) = match declaration {\n        SecretTomlConfig::Env(env) => (env, None, false),\n        SecretTomlConfig::Options(options) => {\n            (options.env, options.description, options.allow_empty)\n        }\n    };\n    if !valid_env_name(&env) {\n        bail!(\"bootstrap secret '{name}' has invalid environment variable name '{env}'\");\n    }\n    Ok(SecretDeclaration {\n        name,\n        env,\n        description,\n        allow_empty,\n    })\n}\n","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/secrets.rs#L409-L445","documentation":"Bootstrap secret names are used as keys in config and possibly in external stores, so mise validates them against a strict charset: ASCII letters, digits, '.', '_' and '-'. An empty name or one containing other characters is rejected at parse time.","triggerScenarios":"declaration_from_toml is invoked from secrets_from_config_files while parsing a [bootstrap.secrets.*] table whose key is empty or contains spaces, slashes, unicode, or symbols outside the allowed set.","commonSituations":"Writing a secret key with a space (\"MY KEY\"), using a path-like name (\"auth/token\"), or accidentally leaving an empty table header [bootstrap.secrets.\"] after an edit.","solutions":["Rename the secret key in the config to only ASCII letters, digits, '.', '_' or '-'","Check for empty or malformed table headers in the [bootstrap.secrets] section","If the secret must map to a differently-named backend key, keep the config name simple and put the complex name in the env/target field"],"exampleFix":"# before\n[bootstrap.secrets.\"auth/token\"]\nenv = \"AUTH_TOKEN\"\n# after\n[bootstrap.secrets.auth_token]\nenv = \"AUTH_TOKEN\"","handlingStrategy":"validation","validationCode":"fn valid_secret_name(name: &str) -> bool {\n    !name.is_empty()\n        && name.chars().all(|c| c.is_ascii_alphanumeric() || \"_.-\".contains(c))\n}\n// run over all keys under [bootstrap.secrets] before loading config","typeGuard":"fn is_valid_secret_key(key: &toml::Value) -> bool {\n    key.as_str().map(valid_secret_name).unwrap_or(false)\n}","tryCatchPattern":null,"preventionTips":["Avoid spaces, slashes and unicode in secret keys","Never leave an empty table header like [bootstrap.secrets.\"]","Pick plain snake_case secret names"],"tags":["validation","naming","secrets","config"],"backgroundTag":"invalid-identifier-format","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}