phacility/phabricator · error · Exception

Keyring configuration is invalid: it describes multiple keys

Error message

Keyring configuration is invalid: it describes multiple keys with the same name ("%s"). Each key must have a unique name.

What it means

The keyring validator collects key names as it walks the list and rejects the config when a second entry reuses a name already seen. Key names are the lookup key for PhabricatorKeyring::getKey(), so duplicates would make key resolution ambiguous. Each entry must have a unique name.

Source

Thrown at src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php:49

          $spec,
          array(
            'name' => 'string',
            'type' => 'string',
            'material.base64' => 'string',
            'default' => 'optional bool',
          ));
      } catch (Exception $ex) {
        throw new Exception(
          pht(
            'Keyring configuration has an invalid key specification (at '.
            'index "%s"): %s.',
            $index,
            $ex->getMessage()));
      }

      $name = $spec['name'];
      if (isset($map[$name])) {
        throw new Exception(
          pht(
            'Keyring configuration is invalid: it describes multiple keys '.
            'with the same name ("%s"). Each key must have a unique name.',
            $name));
      }
      $map[$name] = true;

      if (idx($spec, 'default')) {
        $defaults[] = $name;
      }

      $type = $spec['type'];
      switch ($type) {
        case 'aes-256-cbc':
          if (!function_exists('openssl_encrypt')) {
            throw new Exception(
              pht(
                'Keyring is configured with a "%s" key, but the PHP OpenSSL '.

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Rename duplicates to unique, meaningful names (e.g. prod-2023, prod-2024) — this is also what enables later rotation
2. Remove stale entries you intended to replace instead of keeping both with the same name

Example fix

// before
[
  {"name": "prod", "type": "aes-256-cbc", "material.base64": "<OLD>", "default": true},
  {"name": "prod", "type": "aes-256-cbc", "material.base64": "<NEW>"}
]

// after
[
  {"name": "prod-2023", "type": "aes-256-cbc", "material.base64": "<OLD>"},
  {"name": "prod-2024", "type": "aes-256-cbc", "material.base64": "<NEW>", "default": true}
]

$seen = array();
foreach ($value as $spec) {
  $name = $spec['name'];
  if (isset($seen[$name])) {
    // Duplicate key name "{$name}"; rename entries before saving.
  }
  $seen[$name] = true;
}

When it happens

Trigger: Copy-pasting a key entry for rotation and forgetting to change the name; merging two keyring configs that both contain a key named 'default' or 'prod'.

Common situations: Key rotation done by duplicating an entry and editing only the material; combining environment configs during a merge.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Keyring configuration is not valid: value must be a list of
• Keyring configuration is not valid: each entry in the list m
• Keyring configuration has an invalid key specification (at i
• Keyring specifies an invalid key ("%s"): key material should
• Keyring specifies an invalid key ("%s"): key material should

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/a07396ca4f944a46. Report an issue: GitHub.