passbolt/passbolt_api · error · Exception

The subscription format is not valid.

Error message

The subscription format is not valid.

What it means

The submitted subscription key string could not be base64-decoded into a non-empty value, so SubscriptionKeyAsciiForm::getArmoredSignedSubscription() rejects it before any OpenPGP parsing. The library expects the subscription key to be the base64 encoding of an armored signed message.

Solutions

1. Ensure you are using the exact base64 subscription key string provided by passbolt, not the decoded armored message.
2. Validate locally: `echo '<key>' | base64 -d | head -1` should output '-----BEGIN PGP MESSAGE-----'.
3. Trim surrounding whitespace/quotes; re-copy the key in full from the source email or account portal.
4. Request a fresh key if the string appears truncated.

Example fix

// before: raw armored block passed as key
createOrUpdate($uac, "-----BEGIN PGP MESSAGE-----\n...");
// after: base64 of the armored block (as delivered)
createOrUpdate($uac, 'LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0t...');

if (empty($key) || base64_decode($key, true) === false) {
    throw new \InvalidArgumentException('Key must be a non-empty base64 string');
}

try {
    $armored = $form->getArmoredSignedSubscription($key);
} catch (\Exception $e) {
    return false; // form-rule path, or surface 'invalid format' to user
}

When it happens

Trigger: Calling getArmoredSignedSubscription() (or the form validation via checkSubscriptionFormat / parse) with an empty-looking or non-base64 string: base64_decode() fails (strict semantics on invalid chars, returns ''/'false'), e.g. a raw armored '-----BEGIN PGP SIGNATURE-----' block pasted directly instead of its base64 wrapper.

Common situations: Pasting the raw OpenPGP armored message instead of the base64 subscription key; copying only part of the key; the key getting URL-mangled (e.g. in a query string); uploading an empty file as the subscription key.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The subscription format is not valid. Invalid format.
• Only administrators can delete the subscription.
• Subscription key could not be found.
• The subscription cannot be verified. Parse error.
• The subscription key cannot be verified.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/828da2c8607db352. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Subscription/src/Form/SubscriptionKeyAsciiForm.php:160

        }

        $subscriptionInfo['data'] = trim($keyAscii);

        return SubscriptionKeyDto::createFromArray($subscriptionInfo);
    }

    /**
     * Get the armored subscription.
     *
     * @param string $keyAscii key in ascii
     * @return string The armored signed subscription
     * @throws \Exception If the subscription format is not valid
     */
    public function getArmoredSignedSubscription(string $keyAscii): string
    {
        $armoredSignedSubscription = base64_decode($keyAscii);
        if (!$armoredSignedSubscription) {
            throw new Exception(__('The subscription format is not valid.'));
        }

        $isSignedMessage = $this->getGpg()->isParsableArmoredSignedMessage($armoredSignedSubscription);
        if (!$isSignedMessage) {
            throw new Exception(__('The subscription format is not valid. Invalid format.'));
        }

        return $armoredSignedSubscription;
    }

    /**
     * Verify the subscription signature
     *
     * @param string $subscriptionSigned The signed subscription to verify.
     * @psalm-suppress InvalidNullableReturnType always returns a string
     * @return string The subscription info.
     * @throws \Exception If the gpg public subscription key cannot be imported into the keyring
     * @throws \Exception If the subscription cannot be verified

View on GitHub (pinned to 31c1bbc10f)