phacility/phabricator · error · Exception

Keyring configuration is invalid: it describes a key with ty

Error message

Keyring configuration is invalid: it describes a key with type "%s", but this type is unknown.

What it means

The keyring validator switches on each entry's type field and currently only knows 'aes-256-cbc'; any other string is rejected as unknown. The type selects the validation and crypto implementation for the key, so a typo or an unsupported algorithm cannot be silently accepted.

Source

Thrown at src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php:93

          if ($material === false) {
            throw new Exception(
              pht(
                'Keyring specifies an invalid key ("%s"): key material '.
                'should be base64 encoded.',
                $name));
          }

          if (strlen($material) != 32) {
            throw new Exception(
              pht(
                'Keyring specifies an invalid key ("%s"): key material '.
                'should be 32 bytes (256 bits) but has length %s.',
                $name,
                new PhutilNumber(strlen($material))));
          }
          break;
        default:
          throw new Exception(
            pht(
              'Keyring configuration is invalid: it describes a key with '.
              'type "%s", but this type is unknown.',
              $type));
      }
    }

    if (count($defaults) > 1) {
      throw new Exception(
        pht(
          'Keyring configuration is invalid: it describes multiple default '.
          'encryption keys. No more than one key may be the default key. '.
          'Keys currently configured as defaults: %s.',
          implode(', ', $defaults)));
    }
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Set type exactly to "aes-256-cbc" (lowercase, with mode suffix)
2. Remove entries for algorithms Phabricator does not implement rather than hoping they are ignored

Example fix

// before
{"name": "prod", "type": "aes-256", "material.base64": "..."}

// after
{"name": "prod", "type": "aes-256-cbc", "material.base64": "..."}

$known_types = array('aes-256-cbc');
if (!in_array($spec['type'], $known_types, true)) {
  // Type "{$spec['type']}" is not supported; use aes-256-cbc.
}

When it happens

Trigger: type set to 'aes-256' (dropped cipher mode), 'AES-256-CBC' (wrong case), 'aes-128-cbc', or a speculative future type; value copied from a different system's key config.

Common situations: Hand-writing the type from memory; adapting key config from another product with different algorithm names.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Keyring specifies an invalid key ("%s"): key material should
• No AES256 key is specified in the keyring as a default encry
• No key "%s" exists in keyring.
• Keyring configuration is not valid: value must be a list of
• Keyring configuration is not valid: each entry in the list m

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b19c09a2fc63ce9a. Report an issue: GitHub.