pulumi/pulumi · error

decoding session key: %w

Error message

decoding session key: %w

What it means

After a successful session creation, the API returns the session key as a base64 string. This error wraps a failure of `base64.StdEncoding.DecodeString(resp.SessionKey)`, meaning the server returned a key that is not valid standard base64.

Source

Thrown at pkg/cmd/pulumi/logs/share.go:264

) (sessionID string, sessionKey []byte, err error) {
	// Resolve the cloud URL without requiring login — this endpoint needs no auth.
	cloudURL := httpstate.ValueOrDefaultURL(ws, "")
	if cloudURL == "" {
		return "", nil, errors.New("could not determine Pulumi Cloud URL; set PULUMI_API or run `pulumi login`")
	}
	insecure := pkgWorkspace.GetCloudInsecure(ws, cloudURL)

	apiClient := client.NewClient(cloudURL, "" /*apiToken*/, insecure, cmdutil.Diag())
	resp, err := apiClient.CreateLogEncryptionSession(ctx, apitype.LogEncryptionSessionInitRequest{
		SessionKeyType: apitype.SessionKeyTypePlogV1,
	})
	if err != nil {
		return "", nil, fmt.Errorf("creating encryption session: %w", err)
	}

	keyBytes, err := base64.StdEncoding.DecodeString(resp.SessionKey)
	if err != nil {
		return "", nil, fmt.Errorf("decoding session key: %w", err)
	}

	return resp.SessionID, keyBytes, nil
}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Upgrade the Pulumi CLI and backend so both use the same key encoding
2. Retry the command to get a fresh session
3. If persistent, report the backend returning malformed base64 (file an issue)

// Go: validate base64 before use
if _, err := base64.StdEncoding.DecodeString(resp.SessionKey); err != nil {
    return fmt.Errorf("server returned malformed session key: %w", err)
}

func validBase64(s string) bool {
    _, err := base64.StdEncoding.DecodeString(s)
    return err == nil && s != ""
}

if err := shareLogs(...); err != nil {
    if strings.Contains(err.Error(), "decoding session key") {
        // CLI/server encoding mismatch: upgrade CLI and retry
        return upgradeAndRetry()
    }
    return err
}

When it happens

Trigger: CreateLogEncryptionSession returns a SessionID but its SessionKey string contains characters outside the standard base64 alphabet, is empty, or has invalid padding.

Common situations: Server/client version mismatch where the key is returned URL-safe encoded or with different padding; corrupted or mocked API response; backend bug.

Related errors

• failed to decode base64 data: %w
• malformed byte string for %q: value is not valid base64: %w
• malformed byte string: unable to parse 'value' field: %w
• creating agent Pulumi account: signup response did not inclu
• unexpected response from server

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/99a677c5ecc450a7. Report an issue: GitHub.