coleam00/Archon · error · AppPrivateKeyError

Provided value is not a valid PEM-encoded private key (missi

Error message

Provided value is not a valid PEM-encoded private key (missing BEGIN/END markers).

What it means

assertLooksLikePem performs a cheap sanity check that the provided key text contains BEGIN, PRIVATE KEY, and END markers before it is used. Values failing the check raise AppPrivateKeyError, catching corrupted or wrongly-copied keys early.

Source

Thrown at packages/core/src/github-auth/private-key.ts:54

      assertLooksLikePem(contents);
      return contents;
    } catch (err) {
      if (err instanceof AppPrivateKeyError) throw err;
      throw new AppPrivateKeyError(
        `Failed to read GITHUB_APP_PRIVATE_KEY_PATH (${path}): ${(err as Error).message}`,
        err
      );
    }
  }
  throw new AppPrivateKeyError(
    'GITHUB_APP_ID is set but no private key was provided. ' +
      'Set GITHUB_APP_PRIVATE_KEY (inline PEM) or GITHUB_APP_PRIVATE_KEY_PATH (path to .pem).'
  );
}

function assertLooksLikePem(s: string): void {
  if (!s.includes('BEGIN') || !s.includes('PRIVATE KEY') || !s.includes('END')) {
    throw new AppPrivateKeyError(
      'Provided value is not a valid PEM-encoded private key (missing BEGIN/END markers).'
    );
  }
}

View on GitHub (pinned to 0773b97458)

Solutions

Download the private key (.pem) from the GitHub App settings page and use that file
Ensure newlines survive: use GITHUB_APP_PRIVATE_KEY_PATH instead of inlining, or keep \n escapes intact
Confirm the file contains '-----BEGIN RSA PRIVATE KEY-----' or '-----BEGIN PRIVATE KEY-----'
Regenerate/convert the key with openssl if it is in another format

Example fix

// before
GITHUB_APP_PRIVATE_KEY=MIIEvQIBADANBg...
// after
GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nMIIEvQ...\n-----END RSA PRIVATE KEY-----"

Defensive patterns

Strategy: validation

Validate before calling

const pem = process.env.GITHUB_APP_PRIVATE_KEY;
if (pem && !(pem.includes('BEGIN') && pem.includes('PRIVATE KEY') && pem.includes('END'))) {
  throw new Error('GITHUB_APP_PRIVATE_KEY does not look like a PEM private key');
}

Try / catch

try { const key = await loadAppPrivateKey(env); } catch (e) { if (e instanceof AppPrivateKeyError && e.message.includes('PEM')) console.error('Key file is not a PEM private key; re-download the .pem from GitHub App settings'); throw e; }

Prevention

Reference the .pem file by path instead of pasting contents into env vars
Never use the public .pub key in place of the private key
Ensure secret managers preserve newlines in PEM values

When it happens

Trigger: GITHUB_APP_PRIVATE_KEY contains a public key, a base64 blob without PEM armor, an escaped/mangled PEM (newlines lost), or the file at GITHUB_APP_PRIVATE_KEY_PATH does not contain a private key.

Common situations: Copying the .pub public key instead of the private key; single-line env var where newlines were collapsed; downloading the wrong key format; secret manager stripping newlines.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/402bfcdf609521c0. Report an issue: GitHub.