Unsupported secret backend %s for %s. Supported backends: te

Error message

Unsupported secret backend %s for %s. Supported backends: text

What it means

resolve_secret parses secret specifications of the form backend:value; only the 'text' backend is implemented. Any other backend name (lowercased, trimmed) yields this error naming the backend and the config key (password, etc.). Called from resolve_secrets during ssh config parsing.

Source

Thrown at kittens/ssh/config.go:39

	"github.com/bmatcuk/doublestar/v4"
	"golang.org/x/sys/unix"
)

var _ = fmt.Print

func resolve_secret(key, val string) (string, error) {
	v := strings.TrimSpace(val)
	if v == "" {
		return "", nil
	}
	if b, s, ok := strings.Cut(v, ":"); ok {
		b = strings.ToLower(strings.TrimSpace(b))
		s = strings.TrimSpace(s)
		switch b {
		case "text":
			return s, nil
		default:
			return "", fmt.Errorf("Unsupported secret backend %s for %s. Supported backends: text", b, key)
		}
	}
	return "", fmt.Errorf("No secret backend specified for: %s", key)
}

func resolve_secrets(c *Config, only_syntax bool) error {
	_ = only_syntax // this will be useful when using backends that require user interaction
	if r, err := resolve_secret("password", c.Password); err != nil {
		return err
	} else {
		c.Password = r
	}
	if r, err := resolve_secret("totp_secret", c.Totp_secret); err != nil {
		return err
	} else {
		c.Totp_secret = r
	}
	return nil

View on GitHub (pinned to 6d5d0c4406)

Solutions

Use the text backend: password: text:my-secret-value
Note only 'text' is supported; external backends must be resolved before config is passed
Move secrets out of config files since text stores them in plaintext

Example fix

// before
password: "env:MY_PASSWORD"
// after
password: "text:hunter2"

Defensive patterns

Strategy: validation

Validate before calling

const validBackends = map[string]bool{"text": true}
if !validBackends[backend] { /* reject config early */ }

Type guard

func isSupportedBackend(b string) bool { return strings.ToLower(strings.TrimSpace(b)) == "text" }

Prevention

Only use backend:value syntax with 'text'
Resolve external secret stores in your own code before passing config

When it happens

Trigger: Writing config like password: env:MY_SECRET or password: keychain:foo — any backend prefix other than text:.

Common situations: Users assuming env-var or OS keychain backends exist (they do not in this implementation); copying config from tools with richer secret backends.

Related errors

AI-assisted analysis of kovidgoyal/kitty@6d5d0c4406 (2026-08-27). Data as JSON: /api/errors/aca4db3f816a8fc3. Report an issue: GitHub.