ipfs/kubo · error

cannot show or change private key through API

Error message

cannot show or change private key through API

What it means

'ipfs config' guard block: the requested key is 'Identity' or 'Identity.PrivKey', the node's private key. Reading or writing the key over the RPC API is deliberately forbidden to prevent key exfiltration; use the filesystem and IPFS_PATH instead.

Source

Thrown at core/commands/config.go:93

	Arguments: []cmds.Argument{
		cmds.StringArg("key", true, false, "The key of the config entry (e.g. \"Addresses.API\")."),
		cmds.StringArg("value", false, false, "The value to set the config entry to."),
	},
	Options: []cmds.Option{
		cmds.BoolOption(configBoolOptionName, "Set a boolean value."),
		cmds.BoolOption(configJSONOptionName, "Parse stringified JSON."),
		cmds.BoolOption(configExpandAutoName, "Expand 'auto' placeholders to their expanded values from AutoConf service."),
	},
	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
		args := req.Arguments
		key := args[0]

		var output *ConfigField

		// This is a temporary fix until we move the private key out of the config file
		switch strings.ToLower(key) {
		case "identity", "identity.privkey":
			return errors.New("cannot show or change private key through API")
		default:
		}

		// Temporary fix until we move ApiKey secrets out of the config file
		// (remote services are a map, so more advanced blocking is required)
		if blocked := matchesGlobPrefix(key, config.PinningConcealSelector); blocked {
			return errors.New("cannot show or change pinning services credentials")
		}

		cfgRoot, err := cmdenv.GetConfigRoot(env)
		if err != nil {
			return err
		}
		r, err := fsrepo.Open(cfgRoot)
		if err != nil {
			return err
		}
		defer r.Close()

View on GitHub (pinned to 329838acdf)

Solutions

1. Edit the Identity fields directly in the config file on the machine running the node
2. Use 'ipfs key' commands for key management instead of raw config access

When it happens

Trigger: Thrown at core/commands/config.go:93 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/1aa9aa28dc9ab282. Report an issue: GitHub.