atuinsh/atuin · error · SyncError

the encryption key on this machine does not match the data o

Error message

the encryption key on this machine does not match the data on the server. this usually means a new machine was set up without copying the existing key. to fix: run `atuin key` on a machine that already syncs correctly, then run `atuin store rekey <key>` on this machine with the value from the other machine

What it means

`SyncError::WrongKey` (crates/atuin-client/src/record/sync/mod.rs:83) is thrown during record-store sync when the server holds records this machine cannot decrypt: the local encryption key differs from the key that encrypted the server's data. Atuin syncs end-to-end-encrypted records, so a mismatched key makes downloads undecryptable and uploads inconsistent with the remote history. The error deliberately carries the full remediation instructions in its message.

Source

Thrown at crates/atuin-client/src/record/sync/mod.rs:83

    },

    #[error("operational error: {msg:?}")]
    OperationalError {
        msg: String,
    },

    #[error("a request to the sync server failed: {msg:?}")]
    RemoteRequestError {
        msg: String,
    },

    #[error(
        "the encryption key on this machine does not match the data on the server. this usually \
         means a new machine was set up without copying the existing key. to fix: run `atuin key` \
         on a machine that already syncs correctly, then run `atuin store rekey <key>` on this \
         machine with the value from the other machine"
    )]
    WrongKey,
}

#[derive(Debug, Error)]
pub(crate) enum PackfileDownloadError {
    #[error("failed to load the packfile manifest: {0}")]
    PackManifest(#[from] ParsingError),

    #[error("packfile download failed: {0}")]
    Api(eyre::Report),

    #[error(transparent)]
    Unpack(#[from] UnpackError),

    #[error("failed to store the unpacked history: {0}")]
    Store(eyre::Report),
}

impl PackfileDownloadError {

View on GitHub (pinned to c0c717ab04)

Solutions

1. On a machine that syncs correctly, run `atuin key` to print the existing key
2. On this machine, run `atuin store rekey <key>` with that value to adopt the correct key
3. If no original key exists anywhere (server data is unrecoverable), reset the server-side data and start a fresh encrypted history on this machine
4. Back up `~/.local/share/atuin/key` and restore it on new machines before the first `atuin sync` to prevent recurrence

Example fix

// before: new machine with a freshly generated key
$ atuin sync
// error: the encryption key on this machine does not match the data on the server...
// after: import the key from the working machine, then sync
$ atuin key            # on the old machine — copy the output
$ atuin store rekey <key-from-old-machine>
$ atuin sync

// Before syncing from a new machine, confirm the local key matches
// an existing syncing machine's key:
let local_key = std::fs::read_to_string("~/.local/share/atuin/key")?;
let trusted_key = prompt_user_for_key_from_working_machine();
if local_key.trim() != trusted_key.trim() {
    run("atuin store rekey", &[trusted_key.trim()])?;
}

fn key_matches(local: &str, trusted: &str) -> bool {
    !local.trim().is_empty() && local.trim() == trusted.trim()
}

match atuin_sync().await {
    Err(e) if e.to_string().contains("encryption key on this machine does not match") => {
        eprintln!("Key mismatch: run `atuin key` on the syncing machine, then `atuin store rekey <key>` here.");
        std::process::exit(1);
    }
    Err(e) => return Err(e),
    Ok(()) => {},
}

When it happens

Trigger: Running `atuin sync` (or any record-store sync operation) from a machine whose `~/.local/share/atuin/key` was regenerated or never copied, while the sync server already contains records encrypted with the original key; setting up a new machine without `atuin key --machine` import of the existing key; re-running `atuin key` (or `atuin init`) which overwrites the key file.

Common situations: New laptop/desktop setup where the user created a fresh atuin key instead of copying it from an existing syncing machine; reinstalling the OS and letting `atuin init` generate a new key; accidentally deleting or regenerating the key file; syncing a second machine before importing the primary's key.

Related errors

• invalid id UUID format in sqlite DB
• failed to set absolute path override for {key}
• could not register user due to version mismatch
• Could not login due to version mismatch
• Server not reporting its version: it is either too old or un

AI-assisted analysis of atuinsh/atuin@c0c717ab04 (2026-09-12). Data as JSON: /api/errors/eaea14676987a13a. Report an issue: GitHub.