No key provided and no existing key file found. Please use…

Error message

No key provided and no existing key file found. Please use 'atuin key' on your other machine, or recover your key from a backup

What it means

The user provided an empty encryption key (blank at the prompt, meaning 'use existing key file'), but no key file exists at the expected key path, and the session is non-interactive so the retry prompt loop cannot continue. The key is required to decrypt history; without it login cannot proceed.

Solutions

Provide the key from another machine: run `atuin key` there, then `atuin login --key <key>` here
Restore the key file from your backup to the expected key path before logging in with a blank key
If the key is truly lost, the old encrypted history is unrecoverable; create a new key with `atuin key gen` (losing old history)

Example fix

// before
atuin login  # blank key, no key file, non-interactive
// after
other$ atuin key          # copy output
atuin login --key '<key from other machine>'

Defensive patterns

Strategy: validation

Validate before calling

KEY_FILE="${ATUIN_DATA_DIR:-$HOME/.local/share/atuin}/key"
if [ -z "$ATUIN_KEY" ] && [ ! -f "$KEY_FILE" ]; then
  echo 'No key available: fetch it from another machine with `atuin key`'; exit 1
fi

Try / catch

if ! atuin login --key "$ATUIN_KEY"; then
  echo 'login failed: missing/invalid encryption key'
fi

Prevention

Back up the atuin key file securely when first created
Sync the key (secret manager) before setting up new machines
Never rely on blank-key+'existing file' behavior on fresh installs

When it happens

Trigger: Pressing Enter at the key prompt when no key file exists on the machine (fresh install); running login non-interactively with an empty --key while `~/.local/share/atuin/key` is absent.

Common situations: New laptop/workstation without the synced key file; CI runners expecting an existing key; users who deleted or never backed up their key and try to log in elsewhere.

Related errors

AI-assisted analysis of atuinsh/atuin@900007c480 (2026-09-19). Data as JSON: /api/errors/dacbd8eaab542212. Report an issue: GitHub.

Appendix: source

Thrown at crates/atuin/src/command/client/account/login.rs:219

        let interactive = self.interactive();
        let mut flag_key = self.key.clone();

        loop {
            let key = match flag_key.take() {
                Some(key) => key,
                None => match read_user_input("encryption key [blank to use existing key file]") {
                    Some(key) => key,
                    // Stdin is exhausted, so re-prompting would spin forever.
                    None => bail!("No encryption key provided"),
                },
            };

            if key.is_empty() {
                if !key_path.exists() {
                    let msg = "No key provided and no existing key file found. Please use 'atuin \
                               key' on your other machine, or recover your key from a backup";
                    if !interactive {
                        bail!(msg);
                    }
                    println!("\n{msg}\n");
                    continue;
                }

                paseto_v4::Key::try_load_from_path(key_path).context(format!(
                    "The key in existing key file at '{}' is invalid",
                    key_path.to_string_lossy()
                ))?;

                return Ok(());
            }

            // The key may be EITHER base64 or a bip39 mnemonic.
            match paseto_v4::Key::try_from_mnemonic(&key) {
                Ok(key) => return store_key(settings, store, &key).await,
                Err(err) if interactive => println!("\n{err}. Please try again.\n"),
                Err(err) => return Err(err.into()),

View on GitHub (pinned to 900007c480)