pulumi/pulumi · error

credential store backend %q is not usable here: %w

Error message

credential store backend %q is not usable here: %w

What it means

ForBackend(id) found the requested backend on this platform, but its availability check failed with a non-declined error, so the store cannot be used here. The error wraps the underlying cause, e.g. the Secret Service is unreachable or TPM wrapping is unavailable. This differs from 'not available on this platform': the backend exists but is currently unusable.

Source

Thrown at sdk/go/common/util/securestore/securestore.go:191

			ErrUnavailable, firstErr)
	}
	return &Store{b: backendImpl{id: BackendPlaintext}, fallbackReason: firstErr}, nil
}

// ForBackend returns a store for the backend that produced an existing
// envelope, regardless of mode — reading data back must always be attempted.
func ForBackend(id Backend) (*Store, error) {
	if id == BackendPlaintext {
		return &Store{b: backendImpl{id: BackendPlaintext}}, nil
	}
	for _, cand := range candidates() {
		if cand.id == id {
			outcome, err := cand.available()
			if outcome == Declined {
				return nil, err
			}
			if err != nil {
				return nil, fmt.Errorf("credential store backend %q is not usable here: %w", id, err)
			}
			return &Store{b: cand}, nil
		}
	}
	return nil, fmt.Errorf("credential store backend %q is not available on this platform: %w",
		id, ErrBackendUnsupported)
}

// GetKey never creates a key.
func (s *Store) GetKey() ([]byte, error) {
	if s.b.id == BackendPlaintext {
		return nil, ErrUnavailable
	}
	value, err := s.b.store.get()
	if err != nil {
		return nil, err
	}
	kind, blob, err := parseItem(value)

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Fix the underlying cause reported by the wrapped error: start the secret service (systemctl --user start gnome-keyring-daemon / dbus), or enable Credential Manager.
2. If the data cannot be read here, access it from an environment where the backend works.
3. If the environment permanently lacks the backend, decrypt/migrate the data using the original backend before changing setups.

Example fix

// before
store, err := securestore.ForBackend(env.Backend) // fails: backend not usable here
// after
store, err := securestore.ForBackend(env.Backend)
if err != nil {
    return fmt.Errorf("cannot read data (was it written on this machine with this store?): %w", err)
}

// probe availability before attempting the read
if _, err := securestore.Resolve(securestore.ModeAuto); err != nil {
    // no usable backend here
}

store, err := securestore.ForBackend(env.Backend)
if err != nil {
    return fmt.Errorf("backend %q unusable here (was the data written on this machine?): %w", env.Backend, err)
}

When it happens

Trigger: Calling securestore.ForBackend(id) with a backend identifier read from an on-disk envelope (e.g. "linux-secretservice") whose available() returns an error — secret service not running/dbus down, TPM present but wrapper initialization failed, Windows Credential Manager API error.

Common situations: Reading encrypted data created on a machine where the service was since disabled; SSH session without a running keyring/secret-service; container images missing dbus even though the backend code is compiled in.

Related errors

• credential store backend %q is not available on this platfor
• no usable OS credential protection
• %w: no such credential store on this platform
• no key stored in the OS credential store
• PULUMI_CREDENTIAL_STORE=os but %w (set PULUMI_CREDENTIAL_STO

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/e268f65461eb7e10. Report an issue: GitHub.