semaphoreui/semaphore · error

access key does not suite for inventory's user credentials

Error message

access key does not suite for inventory's user credentials

What it means

When building ansible-playbook arguments, the executor selects SSH arguments based on the inventory's login (user) key type: SSH keys, login/password keys, or explicitly no key (AccessKeyNone). Any other key type (e.g. a key type meant only for become/root or an unknown type) cannot provide user credentials, so preparation fails with this error.

Solutions

1. Open the inventory settings and choose a login access key of type SSH key or login/password
2. Create a suitable access key (SSH private key or username/password) and attach it to the inventory
3. Set the key type to 'none' (AccessKeyNone) if the target genuinely needs no user credentials
4. Upgrade Semaphore so both server and executor recognize the key type in use

Example fix

// before
Inventory.SshKeyID -> key with Type: "vault_generic" (unsupported)
// after
Inventory.SshKeyID -> key with Type: db.AccessKeySSH (ssh private key) or db.AccessKeyLoginPassword

if inv.SshKey != nil {
    switch inv.SshKey.Type {
    case db.AccessKeySSH, db.AccessKeyLoginPassword, db.AccessKeyNone:
        // ok
    default:
        return fmt.Errorf("login key %q type %q not usable for user credentials", inv.SshKey.Name, inv.SshKey.Type)
    }
}

func loginKeyUsable(k *db.AccessKey) bool {
    return k == nil || k.Type == db.AccessKeySSH || k.Type == db.AccessKeyLoginPassword || k.Type == db.AccessKeyNone
}

When it happens

Trigger: Attaching an access key as the inventory's login key whose db.AccessKey.Type is not ssh/privatekey, login_password, or none — for instance selecting an unsupported/newer key type, or a key of the wrong kind saved to Inventory.SshKeyID.

Common situations: User picks the wrong access key in the inventory form; a key of a new type created by a newer Semaphore version is used with an older executor; migration left an unexpected key type on the inventory.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Related errors

• invalid ssh key
• invalid access key type
• invalid inventory type
• access key does not suite for inventory's sudo user…
• err

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/6c42e307ab1b5b9d. Report an issue: GitHub.

Appendix: source

Thrown at services/tasks/local_executor.go:483

	}

	if t.Inventory.SSHKeyID != nil {
		switch t.Inventory.SSHKey.Type {
		case db.AccessKeySSH:
			if t.sshKeyInstallation.Login != "" {
				args = append(args, "--user", t.sshKeyInstallation.Login)
			}
		case db.AccessKeyLoginPassword:
			if t.sshKeyInstallation.Login != "" {
				args = append(args, "--user", t.sshKeyInstallation.Login)
			}
			if t.sshKeyInstallation.Password != "" {
				args = append(args, "--ask-pass")
				inputMap[db.AccessKeyRoleAnsibleUser] = t.sshKeyInstallation.Password
			}
		case db.AccessKeyNone:
		default:
			err = fmt.Errorf("access key does not suite for inventory's user credentials")
			return
		}
	}

	if t.Inventory.BecomeKeyID != nil {
		switch t.Inventory.BecomeKey.Type {
		case db.AccessKeyLoginPassword:
			if t.becomeKeyInstallation.Login != "" {
				args = append(args, "--become-user", t.becomeKeyInstallation.Login)
			}
			if t.becomeKeyInstallation.Password != "" {
				args = append(args, "--ask-become-pass")
				inputMap[db.AccessKeyRoleAnsibleBecomeUser] = t.becomeKeyInstallation.Password
			}
		case db.AccessKeyNone:
		default:
			err = fmt.Errorf("access key does not suite for inventory's sudo user credentials")
			return

View on GitHub (pinned to 1774ccb71a)