ipfs/kubo · error

cannot list keys in keystore: %w

Error message

cannot list keys in keystore: %w

What it means

KeyAPI.List starts by enumerating all keystore entries. If repo.Keystore().List() fails (underlying datastore error, keystore file unreadable/corrupt), the error is wrapped with 'cannot list keys in keystore'.

Source

Thrown at core/coreapi/key.go:136

		return nil, err
	}

	pid, err := peer.IDFromPublicKey(pk)
	if err != nil {
		return nil, err
	}

	return newKey(name, pid)
}

// List returns a list keys stored in keystore.
func (api *KeyAPI) List(ctx context.Context) ([]coreiface.Key, error) {
	_, span := tracing.Span(ctx, "CoreAPI.KeyAPI", "List")
	defer span.End()

	keys, err := api.repo.Keystore().List()
	if err != nil {
		return nil, fmt.Errorf("cannot list keys in keystore: %w", err)
	}

	sort.Strings(keys)

	out := make([]coreiface.Key, 1, len(keys)+1)
	out[0], err = newKey("self", api.identity)
	if err != nil {
		return nil, err
	}

	for _, k := range keys {
		privKey, err := api.repo.Keystore().Get(k)
		if err != nil {
			log.Errorf("cannot get key from keystore: %s", err)
			continue
		}

		pubKey := privKey.GetPublic()

View on GitHub (pinned to 329838acdf)

Solutions

1. Check the wrapped %w cause for the underlying datastore/OS error.
2. Fix file permissions on $IPFS_PATH/keystore so the daemon user can read it.
3. Verify the repo datastore health and disk space.
4. Restore the keystore from backup if entries are corrupted.

Example fix

// before
sudo -u otheruser ipfs key list
// after
chown -R ipfs:ipfs ~/.ipfs/keystore && sudo -u ipfs ipfs key list

if _, err := os.Stat(filepath.Join(repoPath, "keystore")); err != nil {
    return fmt.Errorf("keystore directory unreadable: %w", err)
}

keys, err := api.Key().List(ctx)
if err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) {
        // permission or IO problem on keystore: fix perms/disk before retry
    }
    return fmt.Errorf("cannot list keys in keystore: %w", err)
}

When it happens

Trigger: Calling KeyAPI.List(ctx) (or `ipfs key list`) when the repo keystore cannot be read: permissions changed on repo/keystore, disk I/O failure, corrupted keystore datastore.

Common situations: Running the node/API under a different user than the repo owner (permission denied); read-only filesystem mount; partial migration leaving the keystore inconsistent.

Related errors

• failed to read key: %w
• encoding PEM block: %w
• flushing %s: %w
• cannot create key with name 'self'
• key with name '%s' already exists

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/c125a4d1da7c8bf4. Report an issue: GitHub.