ipfs/kubo · error

key type %T is not allowed to be imported, only RSA, Ed25519

Error message

key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1; use flag --allow-any-key-type if you are sure of what you're doing

What it means

The imported key parsed fine, but its type is not one kubo allows by default (RSA, Ed25519, Secp256k1) — matching the key types ipfs can generate. Importing other types (e.g. ECDSA) is blocked unless `--allow-any-key-type` is passed explicitly, because such keys cannot be generated by kubo and may behave unexpectedly with IPNS.

Source

Thrown at core/commands/keystore.go:536

				if pemBlock != nil {
					return fmt.Errorf("unexpected PEM block for format=%s: try again with format=%s", keyFormatLibp2pCleartextOption, keyFormatPemCleartextOption)
				}
				return fmt.Errorf("unable to unmarshall format=%s: %w", keyFormatLibp2pCleartextOption, err)
			}

		default:
			return fmt.Errorf("unrecognized import format: %s", importFormat)
		}

		// We only allow importing keys of the same type we generate (see list in
		// https://github.com/ipfs/interface-go-ipfs-core/blob/1c3d8fc/options/key.go#L58-L60),
		// unless explicitly stated by the user.
		allowAnyKeyType, _ := req.Options[keyAllowAnyTypeOptionName].(bool)
		if !allowAnyKeyType {
			switch t := sk.(type) {
			case *crypto.RsaPrivateKey, *crypto.Ed25519PrivateKey, *crypto.Secp256k1PrivateKey:
			default:
				return fmt.Errorf("key type %T is not allowed to be imported, only RSA, Ed25519, or Secp256k1;"+
					" use flag --%s if you are sure of what you're doing",
					t, keyAllowAnyTypeOptionName)
			}
		}

		cfgRoot, err := cmdenv.GetConfigRoot(env)
		if err != nil {
			return err
		}

		r, err := fsrepo.Open(cfgRoot)
		if err != nil {
			return err
		}
		defer r.Close()

		_, err = r.Keystore().Get(name)
		if err == nil {

View on GitHub (pinned to 329838acdf)

Solutions

1. If you are sure, add the flag: `ipfs key import name -f pem-pkcs8-cleartext --allow-any-key-type key.pem`
2. Otherwise regenerate the key as Ed25519 (`openssl genpkey -algorithm ED25519`) or RSA and re-import
3. Check the key algorithm with `openssl pkey -in key.pem -noout -text` to confirm which type you have

Example fix

// before
$ ipfs key import mykey -f pem-pkcs8-cleartext ecdsa.pem
Error: key type *crypto.EcdsaPrivateKey is not allowed...
// after (intentional import)
$ ipfs key import mykey -f pem-pkcs8-cleartext --allow-any-key-type ecdsa.pem
// or replace with a supported key
$ openssl genpkey -algorithm ED25519 -out key.pem

txt, _ := exec.Command("openssl", "pkey", "-in", keyFile, "-noout", "-text").Output()
allowed := bytes.Contains(txt, []byte("ED25519")) || bytes.Contains(txt, []byte("Private-Key: ("))
if !allowed && !allowAnyType {
    return fmt.Errorf("key algorithm not in {RSA, Ed25519, Secp256k1}; pass --allow-any-key-type or regenerate")
}

When it happens

Trigger: `ipfs key import name -f pem-pkcs8-cleartext` with an ECDSA (or other exotic) PKCS8 key, without `--allow-any-key-type`. Note: if KeyPairFromStdKey cannot convert the type at all you hit error 342 first; this fires for types that convert but are not whitelisted.

Common situations: Importing openssl EC keys or keys from other crypto stacks; automation importing pre-generated corporate keys of unsupported algorithms.

Related errors

• refusing to export key to %s: not a regular file, character
• cannot import key with name 'self'
• PEM block not found in input data: %s
• expected PRIVATE KEY type in PEM block but got: %s
• parsing PKCS8 format: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/72aec55f4cab1f3b. Report an issue: GitHub.