ipfs/kubo · error

failed to get PrivKey

Error message

failed to get PrivKey

What it means

`nodePeerID` derives the PeerID from Identity.PrivKey in the repo config; it first calls getConfig(r, config.PrivKeySelector) to fetch the key. If that read fails for any reason (config unreadable, key missing), the specific cause is discarded and this generic message is returned. It is used by `ipfs id`-style flows and replaceConfig to validate the new config's key.

Source

Thrown at core/commands/config.go:630

	editorAndArgs, err := parseEditorCommand(editor)
	if err != nil {
		return fmt.Errorf("cannot parse $EDITOR value: %s", err)
	}
	editor = editorAndArgs[0]
	args := append(editorAndArgs[1:], filename)

	cmd := exec.Command(editor, args...)
	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
	return cmd.Run()
}

// nodePeerID derives the PeerID implied by the private key stored in the repo
// config. Identity.PeerID must equal this value; the node refuses to start
// when the two disagree.
func nodePeerID(r repo.Repo) (peer.ID, error) {
	keyF, err := getConfig(r, config.PrivKeySelector)
	if err != nil {
		return "", errors.New("failed to get PrivKey")
	}
	pkstr, ok := keyF.Value.(string)
	if !ok {
		return "", errors.New("private key in config was not a string")
	}
	ident := config.Identity{PrivKey: pkstr}
	pk, err := ident.DecodePrivateKey("")
	if err != nil {
		return "", fmt.Errorf("failed to decode PrivKey: %w", err)
	}
	id, err := peer.IDFromPrivateKey(pk)
	if err != nil {
		return "", fmt.Errorf("failed to derive PeerID from PrivKey: %w", err)
	}
	return id, nil
}

func replaceConfig(r repo.Repo, file io.Reader) error {

View on GitHub (pinned to 329838acdf)

Solutions

1. Ensure the config contains Identity.PrivKey: check with `ipfs config show | jq '.Identity | has("PrivKey")'`
2. Never strip the Identity section when editing or replacing config; keep the original config's Identity when using `ipfs config replace`
3. Restore the repo from backup or re-initialize (`ipfs init`) if the key is truly lost — a lost PrivKey means a lost PeerID
4. Check repo readability/permissions if the key exists but cannot be read

Example fix

// before: config replace with a file missing Identity
{ "Addresses": { ... } }
// after: merge new settings into the existing config so Identity.PrivKey is preserved
jq --slurpfile old <(ipfs config show) '.Identity = $old[0].Identity' new-config.json > merged.json
ipfs config replace merged.json

ipfs config show | jq -e '.Identity.PrivKey | type == "string" and length > 0' >/dev/null && echo "PrivKey present" || echo "PrivKey missing — never strip Identity from config"

pid, err := nodePeerID(r)
if err != nil {
    if err.Error() == "failed to get PrivKey" {
        return fmt.Errorf("Identity.PrivKey missing from config: %w", err)
    }
    return err
}

When it happens

Trigger: Calling `ipfs config replace` with a file lacking Identity.PrivKey, or any code path invoking nodePeerID on a repo whose config cannot supply the PrivKey field (missing Identity section, unreadable config).

Common situations: Replacing the config with a trimmed/edited JSON file that dropped the identity block; a corrupt or hand-modified config where Identity.PrivKey was removed; permission problems reading the repo.

Related errors

• cannot set Identity.PeerID to a value that does not match th
• private key in config does not match id: %s != %s
• unrecognized key type: %s
• private key in config was not a string
• failed to decode PrivKey: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/e3445ac44aa0d328. Report an issue: GitHub.