larksuite/cli · error

keychain is corrupted

Error message

keychain is corrupted

What it means

Raised inside the goroutine that fetches the master key from the macOS keychain: the `master.key` item was found, but its value either failed base64 decoding or did not decode to exactly masterKeyBytes. A generic corruption sentinel - the secret exists but is unusable, so stored credentials cannot be decrypted.

Source

Thrown at internal/keychain/keychain_darwin.go:90

	defer cancel()

	type result struct {
		key []byte
		err error
	}
	resCh := make(chan result, 1)
	go func() {
		defer func() { recover() }()

		encodedKey, err := keyringGet(service, "master.key")
		if err == nil {
			key, decodeErr := base64.StdEncoding.DecodeString(encodedKey)
			if decodeErr == nil && len(key) == masterKeyBytes {
				resCh <- result{key: key, err: nil}
				return
			}
			// Key is found but invalid or corrupted
			resCh <- result{key: nil, err: errors.New("keychain is corrupted")}
			return
		} else if !errors.Is(err, keyring.ErrNotFound) {
			// Not ErrNotFound, which means access was denied or blocked by the system
			resCh <- result{key: nil, err: errKeychainBlocked}
			return
		}

		// If ErrNotFound, check if we are allowed to create a new key
		if !allowCreate {
			// Creation not allowed (e.g., during Get operation), return error
			resCh <- result{key: nil, err: errNotInitialized}
			return
		}

		// It's the first time and creation is allowed (Set operation), generate a new key
		key := make([]byte, masterKeyBytes)
		if _, randErr := rand.Read(key); randErr != nil {
			resCh <- result{key: nil, err: randErr}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Delete the corrupted `master.key` keychain item and run any auth command to generate a fresh master key (previously stored secrets must be re-created)

When it happens

Trigger: Thrown at internal/keychain/keychain_darwin.go:90 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/281895775408c684. Report an issue: GitHub.