What causes "invalid sealer secret prefix" in nikivdev/code?

Pass the full secret string including the "sealerSecret_z" prefix.

invalid sealer secret prefix

Error message

invalid sealer secret prefix

What it means

get_sealer_id parses a sealer secret string that must begin with the literal prefix "sealerSecret_z" before base58-decoding the key material. If the input lacks that prefix the strip_prefix fails and this error is thrown. It almost always means the wrong kind of string (an ID, a raw key, or a truncated value) was passed instead of a sealer secret.

Source

Thrown at src/sealer_crypto.rs:24

};
use rand::{TryRng, rngs::SysRng};
use x25519_dalek::{PublicKey, StaticSecret};

const SECRET_PREFIX: &str = "sealerSecret_z";
const ID_PREFIX: &str = "sealer_z";

pub fn new_x25519_private_key() -> Vec<u8> {
    let mut bytes = [0u8; 32];
    SysRng
        .try_fill_bytes(&mut bytes)
        .expect("system RNG should provide x25519 key material");
    bytes.to_vec()
}

pub fn get_sealer_id(secret: &str) -> Result<String> {
    let secret_raw = secret
        .strip_prefix(SECRET_PREFIX)
        .ok_or_else(|| anyhow::anyhow!("invalid sealer secret prefix"))?;
    let private_bytes = bs58::decode(secret_raw)
        .into_vec()
        .map_err(|e| anyhow::anyhow!("invalid base58 sealer secret: {e}"))?;
    let bytes: [u8; 32] = private_bytes
        .as_slice()
        .try_into()
        .map_err(|_| anyhow::anyhow!("invalid sealer secret length"))?;

    let public = PublicKey::from(&StaticSecret::from(bytes)).to_bytes();
    Ok(format!(
        "{}{}",
        ID_PREFIX,
        bs58::encode(public).into_string()
    ))
}

pub fn seal(
    message: &[u8],

View on GitHub (pinned to a747e741ae)

Solutions

Pass the full secret string including the "sealerSecret_z" prefix.
If you have the raw 32-byte key material, re-encode it as "sealerSecret_z" + base58(bytes) before use.
Check the env var / config source: make sure SEALER-style secret vars are not confused with id vars.
Regenerate the identity with create_sealer_identity if the original secret was lost or malformed.

Example fix

// before
let id = get_sealer_id("5Kd3NBoAd2...")?; // raw base58, no prefix
// after
let id = get_sealer_id("sealerSecret_z5Kd3NBoAd2...")?;

Defensive patterns

Strategy: validation

Validate before calling

fn is_valid_sealer_secret_format(s: &str) -> bool {
    s.starts_with("sealerSecret_z") && s.len() > "sealerSecret_z".len()
}

Type guard

fn is_sealer_secret(s: &str) -> bool {
    s.starts_with("sealerSecret_z")
}
fn is_sealer_id(s: &str) -> bool {
    s.starts_with("sealer_z")
}

Try / catch

match get_sealer_id(secret) {
    Ok(id) => id,
    Err(e) if e.to_string().contains("invalid sealer secret prefix") => {
        eprintln!("SEALER secret must start with 'sealerSecret_z'; got a different value");
        std::process::exit(2);
    }
    Err(e) => return Err(e),
}

Prevention

Store secrets with their prefix intact; never strip "sealerSecret_z" manually.
Keep id and secret in clearly named, separate env vars (SEALER_ID vs SEALER_SECRET).
Add a startup format check before any crypto call.
Generate identities only via create_sealer_identity so the format is always correct.

When it happens

Trigger: Calling get_sealer_id (directly or via load_env_sealer_identity, create_env_sealer_identity, load_sealer_identity, create_sealer_identity) with a string not starting with "sealerSecret_z" — e.g. a sealer id ("sealer_z..."), a raw base58 key, or an empty value.

Common situations: Setting the env var to a sealer ID instead of the secret, hand-copying the value and dropping the prefix, or an unset/empty env var defaulting to a placeholder string.

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/1a3ba0272d8f5a24. Report an issue: GitHub.