atuinsh/atuin · error · SyncError

the encryption key on this machine does not match the data…

Error message

the encryption key on this machine does not match the data on the server. this usually means a new machine was set up without copying the existing key. to fix: run `atuin key` on a machine that already syncs correctly, then run `atuin store rekey <key>` on this machine with the value from the other machine

What it means

`SyncError::WrongKey` (crates/atuin-client/src/record/sync/mod.rs:83) is thrown during record-store sync when the server holds records this machine cannot decrypt: the local encryption key differs from the key that encrypted the server's data. Atuin syncs end-to-end-encrypted records, so a mismatched key makes downloads undecryptable and uploads inconsistent with the remote history. The error deliberately carries the full remediation instructions in its message.

Solutions

1. On a machine that syncs correctly, run `atuin key` to print the existing key
2. On this machine, run `atuin store rekey <key>` with that value to adopt the correct key
3. If no original key exists anywhere (server data is unrecoverable), reset the server-side data and start a fresh encrypted history on this machine
4. Back up `~/.local/share/atuin/key` and restore it on new machines before the first `atuin sync` to prevent recurrence

Example fix

// before: new machine with a freshly generated key
$ atuin sync
// error: the encryption key on this machine does not match the data on the server...
// after: import the key from the working machine, then sync
$ atuin key            # on the old machine — copy the output
$ atuin store rekey <key-from-old-machine>
$ atuin sync

// Before syncing from a new machine, confirm the local key matches
// an existing syncing machine's key:
let local_key = std::fs::read_to_string("~/.local/share/atuin/key")?;
let trusted_key = prompt_user_for_key_from_working_machine();
if local_key.trim() != trusted_key.trim() {
    run("atuin store rekey", &[trusted_key.trim()])?;
}

fn key_matches(local: &str, trusted: &str) -> bool {
    !local.trim().is_empty() && local.trim() == trusted.trim()
}

match atuin_sync().await {
    Err(e) if e.to_string().contains("encryption key on this machine does not match") => {
        eprintln!("Key mismatch: run `atuin key` on the syncing machine, then `atuin store rekey <key>` here.");
        std::process::exit(1);
    }
    Err(e) => return Err(e),
    Ok(()) => {},
}

When it happens

Trigger: Running `atuin sync` (or any record-store sync operation) from a machine whose `~/.local/share/atuin/key` was regenerated or never copied, while the sync server already contains records encrypted with the original key; setting up a new machine without `atuin key --machine` import of the existing key; re-running `atuin key` (or `atuin init`) which overwrites the key file.

Common situations: New laptop/desktop setup where the user created a fresh atuin key instead of copying it from an existing syncing machine; reinstalling the OS and letting `atuin init` generate a new key; accidentally deleting or regenerating the key file; syncing a second machine before importing the primary's key.

Related errors

• WrongKey
• Config key must be non-empty and must not contain whitespace
• Could not build config
• Could not build default
• Could not deserialize config

AI-assisted analysis of atuinsh/atuin@c0c717ab04 (2026-09-12). Data as JSON: /api/errors/eaea14676987a13a. Report an issue: GitHub.

Appendix: source

Thrown at crates/atuin-client/src/record/sync/mod.rs:83

    },

    #[error("operational error: {msg:?}")]
    OperationalError {
        msg: String,
    },

    #[error("a request to the sync server failed: {msg:?}")]
    RemoteRequestError {
        msg: String,
    },

    #[error(
        "the encryption key on this machine does not match the data on the server. this usually \
         means a new machine was set up without copying the existing key. to fix: run `atuin key` \
         on a machine that already syncs correctly, then run `atuin store rekey <key>` on this \
         machine with the value from the other machine"
    )]
    WrongKey,
}

#[derive(Debug, Error)]
pub(crate) enum PackfileDownloadError {
    #[error("failed to load the packfile manifest: {0}")]
    PackManifest(#[from] ParsingError),

    #[error("packfile download failed: {0}")]
    Api(eyre::Report),

    #[error(transparent)]
    Unpack(#[from] UnpackError),

    #[error("failed to store the unpacked history: {0}")]
    Store(eyre::Report),
}

impl PackfileDownloadError {

View on GitHub (pinned to c0c717ab04)