tursodatabase/turso · error · InvalidOperationException

Encryption Cipher and Encryption Key are local database opti

Error message

Encryption Cipher and Encryption Key are local database options. Use Remote Encryption Cipher and Remote Encryption Key for embedded replicas.

What it means

In the Turso .NET driver, local-database encryption is configured with 'Encryption Cipher'/'Encryption Key', but embedded replicas replicate from a remote primary whose encryption settings must match the remote database. CreateReplicaOptions() rejects local encryption options when building a replica so a mismatch between local and remote encryption cannot silently corrupt the replica; you must use 'Remote Encryption Cipher'/'Remote Encryption Key' instead.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoConnection.cs:553

            AttachReplicaLease(lease);
        }
        catch
        {
            _turso?.Dispose();
            _turso = null;
            if (connectionCreated)
                syncDatabase.ReleaseConnection();
            _ = lease.Release();
            throw;
        }
    }

    internal TursoSyncDatabaseOptions CreateReplicaOptions()
    {
        if (_connectionOptions.GetEncryptionCipher().HasValue
            || !string.IsNullOrWhiteSpace(_connectionOptions["Encryption Key"]))
        {
            throw new InvalidOperationException(
                "Encryption Cipher and Encryption Key are local database options. "
                + "Use Remote Encryption Cipher and Remote Encryption Key for embedded replicas.");
        }

        TursoPartialSyncOptions? partialSync = null;
        if (_connectionOptions.HasPartialSyncOptions)
        {
            partialSync = new TursoPartialSyncOptions
            {
                PrefixLength = _connectionOptions.PartialBootstrapPrefix == 0
                    ? null
                    : _connectionOptions.PartialBootstrapPrefix,
                Query = string.IsNullOrWhiteSpace(_connectionOptions.PartialBootstrapQuery)
                    ? null
                    : _connectionOptions.PartialBootstrapQuery,
                SegmentSize = _connectionOptions.PartialSyncSegmentSize == 0
                    ? null
                    : _connectionOptions.PartialSyncSegmentSize,

View on GitHub (pinned to 6c72522679)

Solutions

1. Remove 'Encryption Cipher' and 'Encryption Key' from the connection string.
2. If the remote primary is encrypted, add 'Remote Encryption Cipher=<cipher>' and 'Remote Encryption Key=<key>' matching the primary's settings.
3. If you only want a local encrypted database (no replication), open it as a plain local connection instead of an embedded replica.

Example fix

// before
new TursoConnection("Data Source=replica.db;Replica Path=replica.db;Encryption Cipher=aes-256-cbc;Encryption Key=secret");
// after
new TursoConnection("Data Source=replica.db;Replica Path=replica.db;Remote Encryption Cipher=aes-256-cbc;Remote Encryption Key=secret");

var opts = new TursoConnectionOptions(connectionString);
if (opts.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(opts["Encryption Key"]))
    throw new ArgumentException("Use Remote Encryption Cipher/Key for embedded replicas, not Encryption Cipher/Key.");

When it happens

Trigger: Calling Open()/OpenAsync() on a TursoConnection whose connection string sets 'Encryption Cipher' or 'Encryption Key' (non-empty) while using an embedded-replica data source (Replica Path / remote URL with replica), which invokes CreateReplicaOptions via syncDatabase/options/partial-sync-modifiers bootstrap paths.

Common situations: Copy-pasting a local-database connection string that already had Encryption Cipher/Key and switching the data source to an embedded replica; attempting to encrypt the local replica file with the same key as the primary.

Related errors

• Remote Encryption Cipher and Remote Encryption Key must be s
• Embedded replica connections are not supported yet by the .N
• Sync Interval requires embedded replica support, which is no
• Pooling is not supported for embedded replica connections ye
• Automatic sync is not supported for embedded replica connect

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-31). Data as JSON: /api/errors/2ba5d8c4f614adee. Report an issue: GitHub.