ipfs/kubo · error

setting private key with API is not supported

Error message

setting private key with API is not supported

What it means

replaceConfig guard for 'ipfs config replace': the supplied replacement config file contains a non-empty Identity.PrivKey. Writing a private key through the API is forbidden (secret-exfiltration risk); the daemon's existing key is preserved instead.

Source

Thrown at core/commands/config.go:657

		return "", fmt.Errorf("failed to decode PrivKey: %w", err)
	}
	id, err := peer.IDFromPrivateKey(pk)
	if err != nil {
		return "", fmt.Errorf("failed to derive PeerID from PrivKey: %w", err)
	}
	return id, nil
}

func replaceConfig(r repo.Repo, file io.Reader) error {
	var newCfg config.Config
	if err := json.NewDecoder(file).Decode(&newCfg); err != nil {
		return errors.New("failed to decode file as config")
	}

	// Handle Identity.PrivKey (secret)

	if len(newCfg.Identity.PrivKey) != 0 {
		return errors.New("setting private key with API is not supported")
	}

	keyF, err := getConfig(r, config.PrivKeySelector)
	if err != nil {
		return errors.New("failed to get PrivKey")
	}

	pkstr, ok := keyF.Value.(string)
	if !ok {
		return errors.New("private key in config was not a string")
	}

	newCfg.Identity.PrivKey = pkstr
	id, err := nodePeerID(r)
	if err != nil {
		return err
	}
	newCfg.Identity.PeerID = id.String()

View on GitHub (pinned to 329838acdf)

Solutions

1. Remove the PrivKey field from the replacement file before 'ipfs config replace'
2. Copy the config file manually on the host if a key migration is truly intended

When it happens

Trigger: Thrown at core/commands/config.go:657 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/e463682066e5c095. Report an issue: GitHub.