phacility/phabricator · error · PhutilArgumentUsageException

Public key "%s" is not an active key.

Error message

Public key "%s" is not an active key.

What it means

Usage exception from `bin/almanac trust-key`: the addressed key exists but $key->getIsActive() is false, i.e. the key was deactivated (or never activated) in Phabricator's SSH key store. Trusting an inactive key would grant authority to a credential that cannot authenticate, so the workflow refuses. Deactivation is Phabricator's soft-delete for SSH keys.

Source

Thrown at src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php:39

    $console = PhutilConsole::getConsole();

    $id = $args->getArg('id');
    if (!$id) {
      throw new PhutilArgumentUsageException(
        pht('Specify a public key to trust with --id.'));
    }

    $key = id(new PhabricatorAuthSSHKeyQuery())
      ->setViewer($this->getViewer())
      ->withIDs(array($id))
      ->executeOne();
    if (!$key) {
      throw new PhutilArgumentUsageException(
        pht('No public key exists with ID "%s".', $id));
    }

    if (!$key->getIsActive()) {
      throw new PhutilArgumentUsageException(
        pht('Public key "%s" is not an active key.', $id));
    }

    if ($key->getIsTrusted()) {
      throw new PhutilArgumentUsageException(
        pht('Public key with ID %s is already trusted.', $id));
    }

    if (!($key->getObject() instanceof AlmanacDevice)) {
      throw new PhutilArgumentUsageException(
        pht('You can only trust keys associated with Almanac devices.'));
    }

    $handle = id(new PhabricatorHandleQuery())
      ->setViewer($this->getViewer())
      ->withPHIDs(array($key->getObject()->getPHID()))
      ->executeOne();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Reactivate the key from its detail page (or re-upload an active copy) if it should be usable, then rerun trust-key.
2. If the key was deactivated intentionally, upload and trust the replacement key instead and point register at its private key.
3. Update automation to discover the current active key's ID rather than pinning an old one.

Example fix

# before
$ bin/almanac trust-key --id 42
Usage Exception: Public key "42" is not an active key.

# after
# web UI: reactivate key 42 (auth/sshkey/view/42/) or upload new active key 57
$ bin/almanac trust-key --id 57

if (!$key->getIsActive()) {
  throw new RuntimeException(
    'Key '.$key->getID().' is deactivated; activate it or upload/trust a new key.');
}

When it happens

Trigger: Trusting a key an admin deactivated during rotation or compromise response; trusting a key that isStill listed by ID but was disabled on the user/device; automation retrying an old key ID after the key was replaced and deactivated.

Common situations: Key-rotation leftovers where old keys are deactivated but scripts still reference them; incident response disabling a leaked key while onboarding its replacement.

Related errors

• No public key exists with ID "%s".
• Specify a private key with --private-key.
• No private key exists at path "%s"!
• This host already has a registered public key ("%s"). Remove
• This host already has a registered private key ("%s"). Remov

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/9baba61c49d01027. Report an issue: GitHub.