ipfs/kubo · error

cannot create new key

Error message

cannot create new key: %w

What it means

newKey builds a key's IPLD path by turning the peer ID into an IPNS name and constructing "/ipns/<name>". If path.NewPath or ipns.NameFromPeer fails (malformed path or peer ID that cannot be converted to an IPNS name), the failure is wrapped as 'cannot create new key'.

Solutions

1. Inspect the wrapped cause to see whether the peer ID or the path construction failed.
2. Verify the keystore entry: `ipfs key list` and remove/recreate the corrupted key.
3. Regenerate the key with `ipfs key gen` if its stored bytes are invalid.
4. Check repo integrity with `ipfs repo verify` / fsck the datastore.

if _, err := peer.IDFromPublicKey(pubKey); err != nil {
    return fmt.Errorf("key has invalid public key: %w", err)
}

func validPeerID(pid peer.ID) bool {
    _, err := peer.ToCid(pid).Bytes()
    return err == nil
}

k, err := newKey(name, pid)
if err != nil {
    // key material corrupted; regenerate this keystore entry
    return nil, fmt.Errorf("keystore entry %q unusable: %w", name, err)
}

When it happens

Trigger: Any KeyAPI operation that materializes a key object (Generate, List, Rename, Remove, Self, Sign) when the peer ID derived from the key's public key cannot produce a valid IPNS name/path.

Common situations: A keystore entry corrupted so its derived peer ID is invalid; peer.IDFromPublicKey succeeded but ipns.NameFromPeer rejected the ID; unexpected identity key formats on repos created by very old or third-party tooling.

Related errors

• cannot import key with name 'self'
• failed to determine peer ID for private key
• invalid IPNS name
• no key by the given name or PeerID was found
• panic(err)

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/89259a271377d23a. Report an issue: GitHub.

Appendix: source

Thrown at core/coreapi/key.go:32

	"github.com/ipfs/kubo/tracing"
	crypto "github.com/libp2p/go-libp2p/core/crypto"
	peer "github.com/libp2p/go-libp2p/core/peer"
	"go.opentelemetry.io/otel/attribute"
	"go.opentelemetry.io/otel/trace"
)

type KeyAPI CoreAPI

type key struct {
	name   string
	peerID peer.ID
	path   path.Path
}

func newKey(name string, pid peer.ID) (*key, error) {
	p, err := path.NewPath("/ipns/" + ipns.NameFromPeer(pid).String())
	if err != nil {
		return nil, fmt.Errorf("cannot create new key: %w", err)
	}
	return &key{
		name:   name,
		peerID: pid,
		path:   p,
	}, nil
}

// Name returns the key name
func (k *key) Name() string {
	return k.name
}

// Path returns the path of the key.
func (k *key) Path() path.Path {
	return k.path
}

View on GitHub (pinned to 329838acdf)