What causes "cannot create key with name 'self'" in ipfs/kubo?

Choose a different key name; 'self' is already implicitly available.

cannot create key with name 'self'

Error message

cannot create key with name 'self'

What it means

'self' is a reserved key name that always refers to the node's identity key. The KeyAPI refuses to generate a new keystore key named 'self' because it would shadow the identity, so Generate returns this error before touching the keystore.

Source

Thrown at core/coreapi/key.go:68

// ID returns key PeerID
func (k *key) ID() peer.ID {
	return k.peerID
}

// Generate generates new key, stores it in the keystore under the specified
// name and returns a base58 encoded multihash of its public key.
func (api *KeyAPI) Generate(ctx context.Context, name string, opts ...caopts.KeyGenerateOption) (coreiface.Key, error) {
	_, span := tracing.Span(ctx, "CoreAPI.KeyAPI", "Generate", trace.WithAttributes(attribute.String("name", name)))
	defer span.End()

	options, err := caopts.KeyGenerateOptions(opts...)
	if err != nil {
		return nil, err
	}

	if name == "self" {
		return nil, errors.New("cannot create key with name 'self'")
	}

	_, err = api.repo.Keystore().Get(name)
	if err == nil {
		return nil, fmt.Errorf("key with name '%s' already exists", name)
	}

	if err := caopts.CheckKeySize(options.Algorithm, options.Size); err != nil {
		return nil, err
	}

	var sk crypto.PrivKey
	var pk crypto.PubKey

	switch options.Algorithm {
	case "rsa":
		if options.Size == -1 {
			options.Size = caopts.DefaultRSALen

View on GitHub (pinned to 329838acdf)

Solutions

Choose a different key name; 'self' is already implicitly available.
Validate/whitelist user-supplied key names before calling Generate.
Use `ipfs key list` to see that 'self' exists and cannot be regenerated.

Example fix

// before
k, err := api.Key().Generate(ctx, name) // name == "self"
// after
if name == "self" {
    return api.Key().Self(ctx)
}
k, err := api.Key().Generate(ctx, name)

Defensive patterns

Strategy: validation

Validate before calling

if name == "self" {
    return errors.New("'self' is reserved; use Key().Self() instead")
}
if len(name) > 4096 || !utf8.ValidString(name) {
    return errors.New("invalid key name")
}

Type guard

func isReservedKeyName(n string) bool { return n == "self" }

Try / catch

k, err := api.Key().Generate(ctx, name)
if err != nil && strings.Contains(err.Error(), "name 'self'") {
    k, err = api.Key().Self(ctx)
}

Prevention

Whitelist or sanitize user-provided key names before Generate
Treat 'self' as an implicit alias, never a generatable name
Add a unit test asserting your name-validation rejects 'self'

When it happens

Trigger: Calling KeyAPI.Generate(ctx, "self") directly, or `ipfs key gen self ...` via the CLI.

Common situations: Scripting key creation from user-supplied names without filtering reserved names; attempting to re-create the identity key under its well-known alias.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/07274faca5448f5b. Report an issue: GitHub.