toeverything/AFFiNE · error · Error

Secure BYOK key storage is not available.

Error message

Secure BYOK key storage is not available.

What it means

assertSupported checks Electron safeStorage.isEncryptionAvailable(); when the OS provides no secure encryption backend, BYOK keys cannot be stored safely and this Error is thrown. Called before readWorkspaceKeys and writeWorkspaceKeys.

Source

Thrown at packages/frontend/apps/electron/src/main/byok-storage/handlers.ts:73

        attachmentSources: string[];
      }>;
    }>;
  };
  sortOrder?: number | null;
  enabled?: boolean | null;
};

type WorkspaceByokKeyInput = Omit<
  WorkspaceByokKey,
  'credential' | 'definition'
> & {
  credential?: string | null;
  definition?: WorkspaceByokKey['definition'];
};

function assertSupported() {
  if (!safeStorage.isEncryptionAvailable()) {
    throw new Error('Secure BYOK key storage is not available.');
  }
}

function hasOwnField(
  key: WorkspaceByokKeyInput,
  field: keyof WorkspaceByokKey
) {
  return Object.prototype.hasOwnProperty.call(key, field);
}

function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === 'object' && value !== null && !Array.isArray(value);
}

function isAllowedStringArray(
  value: unknown,
  allowed: Set<string>
): value is string[] {

View on GitHub (pinned to b4c8548c09)

Solutions

1. Use an OS with a supported secure storage backend (keychain/credential manager) for BYOK keys.
2. Install or unlock the system credential storage, then retry saving the key.
3. On unsupported environments, configure the provider key through another supported channel.

When it happens

Trigger: Thrown at packages/frontend/apps/electron/src/main/byok-storage/handlers.ts:73 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/1ff9d03cf42c88fc. Report an issue: GitHub.