tauri-apps/tauri · error

Unable to write keypair

Error message

Unable to write keypair

What it means

`tauri signer generate --write-keys <path>` persists the secret key at <path> and the public key at <path>.pub via save_keypair. That function returns Err when the secret key file already exists and --force was not passed (the CLI bails with 'Key generation aborted: ... already exists'), or when the path cannot be created/written (missing parent directory, permissions, path is a directory). This expect converts that error into a panic, so the underlying message can be easy to miss.

Source

Thrown at crates/tauri-cli/src/signer/generate.rs:40

  /// Overwrite private key even if it exists on the specified path
  #[clap(short, long)]
  force: bool,
  /// Skip prompting for values
  #[clap(long, env = "CI")]
  ci: bool,
}

pub fn command(mut options: Options) -> Result<()> {
  if options.ci && options.password.is_none() {
    log::warn!("Generating new private key without password. For security reasons, we recommend setting a password instead.");
    options.password.replace("".into());
  }
  let keypair = generate_key(options.password).expect("Failed to generate key");

  if let Some(output_path) = options.write_keys {
    let (secret_path, public_path) =
      save_keypair(options.force, output_path, &keypair.sk, &keypair.pk)
        .expect("Unable to write keypair");

    println!();
    println!("Your keypair was generated successfully:");
    println!("Private: {} (Keep it secret!)", display_path(secret_path));
    println!("Public: {}", display_path(public_path));
    println!("---------------------------")
  } else {
    println!();
    println!("Your keys were generated successfully!",);
    println!();
    println!("Private: (Keep it secret!)");
    println!("{}", keypair.sk);
    println!();
    println!("Public:");
    println!("{}", keypair.pk);
  }

  println!();

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Add --force to overwrite the existing keypair: `tauri signer generate -w ~/.tauri/app.key --force`.
2. Or write to a new path that does not exist yet.
3. Create and check the parent directory first: `mkdir -p ~/.tauri && [ -w ~/.tauri ]`.
4. Back up and remove the old key files if you intentionally want a fresh pair in place.

Example fix

# before: key already exists -> panics 'Unable to write keypair'
$ tauri signer generate -w ~/.tauri/myapp.key

# after: intentionally overwrite
$ tauri signer generate -w ~/.tauri/myapp.key --force

# Precheck the output path before generating
KEY=~/.tauri/myapp.key
mkdir -p "$(dirname "$KEY")" && [ -w "$(dirname "$KEY")" ] || { echo 'output dir missing or read-only'; exit 1; }
[ -e "$KEY" ] && [ "${FORCE:-}" != "1" ] && { echo "refusing to overwrite $KEY — pass --force"; exit 1; }

When it happens

Trigger: Re-running `tauri signer generate -w ~/.tauri/app.key` after a previous run without --force; writing to a directory that does not exist or is not writable; passing a --write-keys value that names an existing directory.

Common situations: CI pipelines re-generating keys into a fixed path on cached runners; users regenerating a lost key over the old public key file; paths under directories not yet created (e.g. ~/.tauri on a fresh machine).

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

• system clock is incorrect
• Failed to generate key
• Key generation aborted: Unable to find the private key
• failed to read cwd
• Couldn't find capabilities directory at {}

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/a4d53af43d040b3b. Report an issue: GitHub.