passbolt/passbolt_api · error · Exception

The subscription format is not valid. Invalid format.

Error message

The subscription format is not valid. Invalid format.

What it means

The string base64-decoded successfully but is not a parsable OpenPGP armored signed message, per OpenPGPBackend::isParsableArmoredSignedMessage(). getArmoredSignedSubscription() throws this when the decoded content lacks a valid PGP signed-message structure.

Solutions

1. Decode and inspect: `echo '<key>' | base64 -d` — it must start with '-----BEGIN PGP MESSAGE-----' and contain a signature packet.
2. Do not modify the key text; submit it verbatim as received from passbolt.
3. Confirm the key is for the correct edition and product version; request a regenerated key from passbolt if the payload structure is unrecognized.

Example fix

// before: base64 of the wrong payload
$bad = base64_encode(file_get_contents('public.key'));
createOrUpdate($uac, $bad);
// after: use the delivered key verbatim
createOrUpdate($uac, $keyFromPassboltAccount);

$decoded = base64_decode($key, true);
if ($decoded === false || strpos($decoded, '-----BEGIN PGP MESSAGE-----') !== 0) {
    throw new \InvalidArgumentException('Key must base64-decode to an armored signed message');
}

try {
    $armored = $form->getArmoredSignedSubscription($key);
} catch (\Exception $e) {
    Log::error('Not a parsable armored signed message');
    // instruct user to use the key verbatim
}

When it happens

Trigger: base64_decode($keyAscii) succeeds on arbitrary text (base64 rarely hard-fails), but the decoded bytes are not a '-----BEGIN PGP MESSAGE-----' block with a signature packet — e.g. wrong content base64-encoded, a public key block, or a partially edited key.

Common situations: Encoding the wrong file/content into base64 and submitting that; passing a license from another vendor; a key mangled by automatic text transformation (smart quotes, HTML escaping) before submission; older or newer subscription format incompatible with the installed passbolt version.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The subscription cannot be verified. Parse error.
• The subscription format is not valid.
• The subscription key cannot be verified.
• Only administrators can delete the subscription.
• Subscription key could not be found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/a75d2795c44fd2b4. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Subscription/src/Form/SubscriptionKeyAsciiForm.php:165

    }

    /**
     * Get the armored subscription.
     *
     * @param string $keyAscii key in ascii
     * @return string The armored signed subscription
     * @throws \Exception If the subscription format is not valid
     */
    public function getArmoredSignedSubscription(string $keyAscii): string
    {
        $armoredSignedSubscription = base64_decode($keyAscii);
        if (!$armoredSignedSubscription) {
            throw new Exception(__('The subscription format is not valid.'));
        }

        $isSignedMessage = $this->getGpg()->isParsableArmoredSignedMessage($armoredSignedSubscription);
        if (!$isSignedMessage) {
            throw new Exception(__('The subscription format is not valid. Invalid format.'));
        }

        return $armoredSignedSubscription;
    }

    /**
     * Verify the subscription signature
     *
     * @param string $subscriptionSigned The signed subscription to verify.
     * @psalm-suppress InvalidNullableReturnType always returns a string
     * @return string The subscription info.
     * @throws \Exception If the gpg public subscription key cannot be imported into the keyring
     * @throws \Exception If the subscription cannot be verified
     */
    protected function _verifySignature(string $subscriptionSigned): string
    {
        $msg = __('The subscription key cannot be verified.');
        $subscription = '';

View on GitHub (pinned to 31c1bbc10f)