phacility/phabricator · error · Exception

Public key type should be one of: %s

Error message

Public key type should be one of: %s

What it means

After splitting, newFromRawKey() validates the first field (key type) against a fixed whitelist: ssh-dsa, ssh-dss, ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256/384/521. Anything else - with the allowed list interpolated into the message - is rejected before the PhabricatorAuthSSHPublicKey object is constructed.

Source

Thrown at src/applications/auth/sshkey/PhabricatorAuthSSHPublicKey.php:70

        // This is the expected case.
        break;
    }

    list($type, $body, $comment) = $parts;

    $recognized_keys = array(
      'ssh-dsa',
      'ssh-dss',
      'ssh-rsa',
      'ssh-ed25519',
      'ecdsa-sha2-nistp256',
      'ecdsa-sha2-nistp384',
      'ecdsa-sha2-nistp521',
    );

    if (!in_array($type, $recognized_keys)) {
      $type_list = implode(', ', $recognized_keys);
      throw new Exception(
        pht(
          'Public key type should be one of: %s',
          $type_list));
    }

    $public_key = new PhabricatorAuthSSHPublicKey();
    $public_key->type = $type;
    $public_key->body = $body;
    $public_key->comment = $comment;

    return $public_key;
  }

  public function getType() {
    return $this->type;
  }

  public function getBody() {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Upload a key of a supported type - generate one with: ssh-keygen -t ed25519
2. If you have a certificate or sk- key, generate a separate plain supported key for Phabricator
3. Check the first word of the pasted line for typos against the allowed list in the error message

// Check the type token against the supported set before parsing:
$supported = array(
  'ssh-dsa', 'ssh-dss', 'ssh-rsa', 'ssh-ed25519',
  'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521',
);
$type = head(explode(' ', trim($raw)));
if (!in_array($type, $supported, true)) {
  return pht('Generate a supported key: ssh-keygen -t ed25519');
}

try {
  $public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($raw);
} catch (Exception $ex) {
  // Message lists every allowed type: relay it verbatim to the user.
  $e_key = $ex->getMessage();
}

When it happens

Trigger: Uploading a key whose type token is not whitelisted: hardware-security keys (sk-ssh-ed25519@openssh.com), OpenSSH certificates (*-cert-v01@openssh.com), legacy ssh-rsa1, or a typo in the type prefix.

Common situations: Newer OpenSSH client features (FIDO/sk- keys), SSH certificates instead of plain public keys, very old RSA1 keys, or hand-typed key lines with the algorithm misspelled.

Related errors

• This public key is already associated with another user or d
• No public key was provided.
• Provide a public key, not a private key!
• Provided public key is not properly formatted.
• Failed to convert public key into PKCS8 format. If you are d

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/bcbcf64ca08dea29. Report an issue: GitHub.