ipfs/kubo · error

cannot import key with name 'self'

Error message

cannot import key with name 'self'

What it means

`ipfs key import` refuses the reserved name 'self', which in IPNS refers to the node's own identity key (the peer's private key). Importing a key under that name would shadow or conflict with the node identity, so it is unconditionally rejected as input validation. Choose any other name for the imported key.

Source

Thrown at core/commands/keystore.go:466

  $ openssl genpkey -algorithm ED25519 > ed25519.pem
  $ ipfs key import test-openssl -f pem-pkcs8-cleartext ed25519.pem
`,
	},
	Options: []cmds.Option{
		ke.OptionIPNSBase,
		cmds.StringOption(keyFormatOptionName, "f", "The format of the private key to import, libp2p-protobuf-cleartext or pem-pkcs8-cleartext.").WithDefault(keyFormatLibp2pCleartextOption),
		cmds.BoolOption(keyAllowAnyTypeOptionName, "Allow importing any key type.").WithDefault(false),
	},
	Arguments: []cmds.Argument{
		cmds.StringArg("name", true, false, "name to associate with key in keychain"),
		cmds.FileArg("key", true, false, "key provided by generate or export"),
	},
	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
		name := req.Arguments[0]

		if name == "self" {
			return fmt.Errorf("cannot import key with name 'self'")
		}

		keyEnc, err := ke.KeyEncoderFromString(req.Options[ke.OptionIPNSBase.Name()].(string))
		if err != nil {
			return err
		}

		file, err := cmdenv.GetFileArg(req.Files.Entries())
		if err != nil {
			return err
		}
		defer file.Close()

		data, err := io.ReadAll(file)
		if err != nil {
			return err
		}

View on GitHub (pinned to 329838acdf)

Solutions

1. Use a different name: `ipfs key import mykey <file>`
2. Sanitize the name argument in scripts (reject 'self' before calling)
3. If the goal was to replace the node identity, that is not supported via key import — re-run `ipfs init` with the desired key or use the repo's identity swap tooling
4. List existing names with `ipfs key list` to pick a non-conflicting one

Example fix

// before
ipfs key import self ed25519.pem
// after
ipfs key import my-openssl-key ed25519.pem

if name == "self":
    raise ValueError("key name 'self' is reserved for the node identity; choose another name")

When it happens

Trigger: `ipfs key import self <file>` or a script parameterizing the key name whose value happens to be 'self'. Also `ipfs key gen self` is rejected the same way.

Common situations: Batch-import scripts iterating a name list that contains 'self'; users wanting to replace their identity key via import (unsupported — use init or a different node); variable interpolation producing an empty-then-default 'self'.

Related errors

• refusing to export key to %s: not a regular file, character
• PEM block not found in input data: %s
• DHT timeout value must be >= 0
• ttl (%s) must not be greater than lifetime (%s)
• invalid configuration profile: %s

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/f4688a7f443a859b. Report an issue: GitHub.