What causes "invalid password key" in semaphoreui/semaphore?

Set LoginPassword.Password to the actual secret before serializing.

invalid password key

Error message

invalid password key

What it means

SerializeSecret for a local-stored LoginPassword access key requires a non-empty password: a key with an empty password but a non-empty login is invalid. The serializer refuses to encrypt/store such a hollow key and returns 'invalid password key'.

Solutions

Set LoginPassword.Password to the actual secret before serializing.
If only a login is needed without a password, clear Login as well or switch the key type to AccessKeyNone.
Add client-side validation that password is non-empty when the key type is login_password.

Example fix

// before
key.LoginPassword = db.LoginPassword{Login: "deploy"}
// after
key.LoginPassword = db.LoginPassword{Login: "deploy", Password: "s3cret"}

Defensive patterns

Strategy: validation

Validate before calling

if key.Type == db.AccessKeyLoginPassword && key.LoginPassword.Password == "" {
    // invalid: require password or clear Login / change key type
}

Try / catch

if err := svc.SerializeSecret(key); err != nil && err.Error() == "invalid password key" { /* prompt for the password and retry */ }

Prevention

Make password a required field when key type is login_password in clients.
Validate non-empty credentials before calling the API.
Audit keys with empty passwords after bulk imports.

When it happens

Trigger: Calling SerializeSecret (e.g. during RekeyAccessKeys) on an AccessKey of type AccessKeyLoginPassword whose LoginPassword.Password is empty while Login is set.

Common situations: API clients submitting login/password keys with the password omitted or blank; credentials rotated to empty by mistake; forms allowing empty password fields.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/429902c926dd1e9c. Report an issue: GitHub.

Appendix: source

Thrown at services/server/access_key_serializer_local.go:54

		}
		plaintext = []byte(key.String)
	case db.AccessKeySSH:
		if key.SshKey.PrivateKey == "" {
			if key.SshKey.Login != "" || key.SshKey.Passphrase != "" {
				return fmt.Errorf("invalid ssh key")
			}
			key.Secret = nil
			return nil
		}

		plaintext, err = json.Marshal(key.SshKey)
		if err != nil {
			return err
		}
	case db.AccessKeyLoginPassword:
		if key.LoginPassword.Password == "" {
			if key.LoginPassword.Login != "" {
				return fmt.Errorf("invalid password key")
			}
			key.Secret = nil
			return nil
		}

		plaintext, err = json.Marshal(key.LoginPassword)
		if err != nil {
			return err
		}
	case db.AccessKeyNone:
		key.Secret = nil
		return nil
	default:
		return fmt.Errorf("invalid access token type")
	}

	secret, err := util.Config.EncryptAccessSecret(plaintext)
	if err != nil {

View on GitHub (pinned to 1774ccb71a)