ipfs/kubo · error

cannot create new key: %w

Error message

cannot create new key: %w

What it means

newKey builds a key's IPLD path by turning the peer ID into an IPNS name and constructing "/ipns/<name>". If path.NewPath or ipns.NameFromPeer fails (malformed path or peer ID that cannot be converted to an IPNS name), the failure is wrapped as 'cannot create new key'.

Source

Thrown at core/coreapi/key.go:32

	"github.com/ipfs/kubo/tracing"
	crypto "github.com/libp2p/go-libp2p/core/crypto"
	peer "github.com/libp2p/go-libp2p/core/peer"
	"go.opentelemetry.io/otel/attribute"
	"go.opentelemetry.io/otel/trace"
)

type KeyAPI CoreAPI

type key struct {
	name   string
	peerID peer.ID
	path   path.Path
}

func newKey(name string, pid peer.ID) (*key, error) {
	p, err := path.NewPath("/ipns/" + ipns.NameFromPeer(pid).String())
	if err != nil {
		return nil, fmt.Errorf("cannot create new key: %w", err)
	}
	return &key{
		name:   name,
		peerID: pid,
		path:   p,
	}, nil
}

// Name returns the key name
func (k *key) Name() string {
	return k.name
}

// Path returns the path of the key.
func (k *key) Path() path.Path {
	return k.path
}

View on GitHub (pinned to 329838acdf)

Solutions

1. Inspect the wrapped cause to see whether the peer ID or the path construction failed.
2. Verify the keystore entry: `ipfs key list` and remove/recreate the corrupted key.
3. Regenerate the key with `ipfs key gen` if its stored bytes are invalid.
4. Check repo integrity with `ipfs repo verify` / fsck the datastore.

if _, err := peer.IDFromPublicKey(pubKey); err != nil {
    return fmt.Errorf("key has invalid public key: %w", err)
}

func validPeerID(pid peer.ID) bool {
    _, err := peer.ToCid(pid).Bytes()
    return err == nil
}

k, err := newKey(name, pid)
if err != nil {
    // key material corrupted; regenerate this keystore entry
    return nil, fmt.Errorf("keystore entry %q unusable: %w", name, err)
}

When it happens

Trigger: Any KeyAPI operation that materializes a key object (Generate, List, Rename, Remove, Self, Sign) when the peer ID derived from the key's public key cannot produce a valid IPNS name/path.

Common situations: A keystore entry corrupted so its derived peer ID is invalid; peer.IDFromPublicKey succeeded but ipns.NameFromPeer rejected the ID; unexpected identity key formats on repos created by very old or third-party tooling.

Related errors

• cannot import key with name 'self'
• invalid IPNS name: %w
• failed to determine peer ID for private key: %w
• no key by the given name or PeerID was found
• panic(err)

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/89259a271377d23a. Report an issue: GitHub.