age encryption is not currently supported, if you need encry

Error message

age encryption is not currently supported, if you need encryption please revert back to Litestream v0.3.x

What it means

Age encryption was removed during the LTX storage layer refactor and is non-functional; configs specifying age identities or recipients are rejected outright so users do not silently write plaintext to remote storage (see litestream issue #790).

Source

Thrown at cmd/litestream/main.go:1362

	Name string `yaml:"name"` // Deprecated
	Path string `yaml:"path"`
	URL  string `yaml:"url"`
}

// NewReplicaFromConfig instantiates a replica for a DB based on a config.
func NewReplicaFromConfig(c *ReplicaConfig, db *litestream.DB) (_ *litestream.Replica, err error) {
	// Ensure user did not specify URL in path.
	if litestream.IsURL(c.Path) {
		return nil, fmt.Errorf("replica path cannot be a url, please use the 'url' field instead: %s", c.Path)
	}

	// Reject age encryption configuration as it's currently non-functional.
	// Age encryption support was removed during the LTX storage layer refactor
	// and has not been reimplemented. Accepting this config would silently
	// write plaintext data to remote storage instead of encrypted data.
	// See: https://github.com/benbjohnson/litestream/issues/790
	if len(c.Age.Identities) > 0 || len(c.Age.Recipients) > 0 {
		return nil, fmt.Errorf("age encryption is not currently supported, if you need encryption please revert back to Litestream v0.3.x")
	}

	// Build replica.
	r := litestream.NewReplica(db)
	if v := c.SyncInterval; v != nil {
		r.SyncInterval = *v
	}
	if v := c.MaxSyncLTXFiles; v != nil {
		r.MaxSyncLTXFiles = *v
	}
	if v := c.AutoRecover; v != nil {
		r.AutoRecoverEnabled = *v
	}

	// Build and set client on replica.
	switch c.ReplicaType() {
	case "file":
		if r.Client, err = newFileReplicaClientFromConfig(c, r); err != nil {

View on GitHub (pinned to 4ed7a308f6)

Solutions

Remove the entire `age:` block from the replica config
If encryption is required, revert to Litestream v0.3.x as the error message states
Re-encrypt backups at the storage layer instead (e.g. bucket-side encryption/KMS)

Example fix

# before
replicas:
  - url: s3://bucket/db
    age:
      recipients: [age1xyz...]
# after
replicas:
  - url: s3://bucket/db

Defensive patterns

Strategy: validation

Validate before calling

if len(cfg.Age.Identities) > 0 || len(cfg.Age.Recipients) > 0 {
    return errors.New("age encryption unsupported; remove age block or pin litestream v0.3.x")
}

Prevention

Remove age blocks when upgrading past the LTX refactor
Use storage-side encryption instead of age
Pin versions deliberately if encryption via age is a hard requirement

When it happens

Trigger: A replica config contains any entries under `age.identities` or `age.recipients`, evaluated in NewReplicaFromConfig at startup.

Common situations: Upgrading encrypted v0.3.x deployments to v0.5+/LTX-era Litestream; copy-pasted configs from old documentation or blog posts recommending age encryption.

Related errors

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/2e68c2f2c37ee6d0. Report an issue: GitHub.