What causes "Could not import the user OpenPGP key." in passbolt/passbolt_api?

Check the chained exception in logs for the precise gnupg import error.

passbolt/passbolt_api · critical · Cake\Http\Exception\InternalErrorException

Could not import the user OpenPGP key.

Error message

Could not import the user OpenPGP key.

What it means

setUserKey imports the authenticated user's armored OpenPGP key into the keyring and sets it as verify/encrypt key for the JWT flow. If import or key-setting fails, 'Could not import the user OpenPGP key.' is thrown as InternalErrorException with the original exception chained. The API cannot encrypt/verify tokens for the user without a valid key.

Solutions

Check the chained exception in logs for the precise gnupg import error.
Have the user re-upload a valid armored public key (account settings > OpenPGP key) and retry login.
Validate the stored armored key integrity (armored block headers/footers, fingerprint matches key body).
Clear and rebuild the GnuPG keyring for the web-server user if it is corrupted.
Verify the gpg/gnupg PHP extension version compatibility with the key algorithm (e.g. very old keys vs new GnuPG).

Defensive patterns

Strategy: validation

Validate before calling

function isValidArmoredKey(key) { return typeof key === 'string' && key.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----') && key.includes('-----END PGP PUBLIC KEY BLOCK-----'); }

Try / catch

try { await jwtLogin(); } catch (e) { if (e.message.includes('Could not import the user OpenPGP key')) promptKeyReupload(); else throw e; }

Prevention

Validate armored key format client-side before uploading user keys.
Ensure fingerprint stored in DB matches the armored key body.
Avoid editing key files with tools that mangle line endings.
Rebuild the keyring cleanly if gnupg import errors accumulate.

When it happens

Trigger: JWT authentication when the user's gpgkey record contains a corrupted, truncated, or malformed armored key; the key was deleted from the keyring; or the gnupg extension rejects the key material during importKeyIntoKeyring / setVerifyKeyFromFingerprint / setEncryptKeyFromFingerprint.

Common situations: Users imported broken armored keys (wrong line endings, missing headers); key revoked or expired on the server; keyring corrupted or recreated without user keys; fingerprints in DB not matching the armored key.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/03f67f4fa7a67c4c. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/JwtAuthentication/src/Authenticator/GpgJwtAuthenticator.php:245

     *
     * @throws \Cake\Http\Exception\BadRequestException if the user data is not valid
     * @throws \Cake\Http\Exception\InternalErrorException if the user key cannot be loaded
     * @return void
     */
    public function setUserKey(): void
    {
        try {
            $this->gpg->setVerifyKeyFromFingerprint($this->user->gpgkey->fingerprint);
            $this->gpg->setEncryptKeyFromFingerprint($this->user->gpgkey->fingerprint);
        } catch (Exception $exception) {
            // Try to import the key in keyring again
            try {
                $this->gpg->importKeyIntoKeyring($this->user->gpgkey->armored_key);
                $this->gpg->setVerifyKeyFromFingerprint($this->user->gpgkey->fingerprint);
                $this->gpg->setEncryptKeyFromFingerprint($this->user->gpgkey->fingerprint);
            } catch (Exception $exception) {
                $msg = __('Could not import the user OpenPGP key.');
                throw new InternalErrorException($msg, 500, $exception);
            }
        }
    }

    /**
     * Load user data including OpenPGP key in $user props
     *
     * @throws \Cake\Http\Exception\BadRequestException if the user id is missing in the request
     * @throws \Cake\Http\Exception\NotFoundException if the user cannot be found, is deleted, is not active
     * @return void
     * @access private
     */
    public function loadUserData(): void
    {
        $userId = $this->request->getData('user_id');
        $this->assertUserId($userId);
        $userData = $this->findUser($userId);
        $this->assertUserData($userData);

View on GitHub (pinned to 31c1bbc10f)