coollabsio/coolify · error · RuntimeException

Your deploy key does not have access to the repository. Plea

Error message

Your deploy key does not have access to the repository. Please check your deploy key and try again.

What it means

During the same clone-and-read flow, Git's stderr contains 'fatal: repository ... does not exist' while the application authenticates with a deploy key. Git hosts (notably GitHub) return this identical message for private repositories the credential cannot read, so Coolify reports it as a deploy-key access problem: the attached key is not registered on that repository (or lacks read access).

Source

Thrown at app/Models/Application.php:2170

                "git sparse-checkout set {$fileList->implode(' ')}",
                'git read-tree -mu HEAD',
                "cat .$workdir$composeFile",
            ]);
        }
        try {
            $composeFileContent = instant_remote_process($commands, $this->destination->server);
        } catch (\Exception $e) {
            // Restore original values on failure only
            $this->docker_compose_location = $initialDockerComposeLocation;
            $this->base_directory = $initialBaseDirectory;
            $this->save();

            if (str($e->getMessage())->contains('No such file')) {
                throw new RuntimeException("Docker Compose file not found at: $workdir$composeFile (branch: {$this->git_branch})<br><br>Check if you used the right extension (.yaml or .yml) in the compose file name.");
            }
            if (str($e->getMessage())->contains('fatal: repository') && str($e->getMessage())->contains('does not exist')) {
                if ($this->deploymentType() === 'deploy_key') {
                    throw new RuntimeException('Your deploy key does not have access to the repository. Please check your deploy key and try again.');
                }
                throw new RuntimeException('Repository does not exist. Please check your repository URL and try again.');
            }
            throw new RuntimeException('Failed to read the Docker Compose file from the repository.');
        } finally {
            // Cleanup only - restoration happens in catch block
            $commands = collect([
                "rm -rf /tmp/{$uuid}",
            ]);
            instant_remote_process($commands, $this->destination->server, false);
        }
        if ($composeFileContent) {
            $this->docker_compose_raw = $composeFileContent;
            $this->save();
            $parsedServices = $this->parse();
            if ($this->docker_compose_domains) {
                $this->reconcileDockerComposeDomains($parsedServices);
            }

View on GitHub (pinned to 70b9acc424)

Solutions

Add the private key's public half to the repository under Settings → Deploy keys (read-only is sufficient for clone/pull).
Confirm the application has the correct PrivateKey attached (compare fingerprints if unsure).
If the key was rotated, update the repo's deploy key to the new public key.
Verify the repository URL is correct — a genuinely wrong URL yields this same error under deploy-key auth.

Defensive patterns

Strategy: validation

Validate before calling

// Confirm the deploy key can read the repo before deploying
$status = $application->getGitRemoteStatus(deployment_uuid: $uuid);
if (! $status['is_accessible'] && $application->deploymentType() === 'deploy_key') { /* instruct: add public key to repo deploy keys */ }

Try / catch

catch (RuntimeException $e) { if (str_contains($e->getMessage(), 'deploy key does not have access')) { stop with instructions to register the key's public half on the repository; retry only after the key is added. } else { throw $e; } }

Prevention

Automate adding the public key to the repo when creating deploy-key applications.
After key rotation, update repo deploy keys in the same operation.
Prefer one key per application to make 'wrong repo' mismatches obvious.

When it happens

Trigger: Deploy key's public half never added to the repo, added to a different repo, or deleted; wrong PrivateKey attached to the application; deploy key regenerated so the public half on the repo no longer matches; repo made private after the key was set up.

Common situations: Copying a key configured for repo A onto application B; rotating keys server-side but not on the Git host; org-level policies removing deploy keys.

Related errors

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/89f1693e1fe70590. Report an issue: GitHub.