tursodatabase/turso · error · InvalidOperationException

Encryption Cipher and Encryption Key are local database opti

Error message

Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.

What it means

OpenRemote's third guard rejects local-only encryption options on remote URLs: Encryption Cipher and Encryption Key configure file-level encryption when opening a local database natively, and are meaningless over the wire, so supplying either (the check ORs a parsed cipher and any non-whitespace 'Encryption Key') with a remote Data Source throws InvalidOperationException at Open().

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoConnection.cs:329

        {
            remoteClient.CloseAsync(DefaultTimeout, CancellationToken.None).GetAwaiter().GetResult();
        }
        catch
        {
            InvalidateRemoteSession();
        }
    }

    private void OpenRemote()
    {
        if (_connectionOptions.IsReplica)
            throw new NotSupportedException("Embedded replica connections are not supported yet by the .NET provider. Use a remote URL without Replica Path for direct remote execution.");

        if (_connectionOptions.SyncInterval > 0)
            throw new NotSupportedException("Sync Interval requires embedded replica support, which is not supported yet by the .NET provider.");

        if (_connectionOptions.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(_connectionOptions["Encryption Key"]))
            throw new InvalidOperationException("Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.");

        _remoteClient = new TursoRemoteClient(_connectionOptions.GetRemoteUri(), _connectionOptions.AuthToken);
    }

    private void ValidateLocalOnlyOptions()
    {
        if (!string.IsNullOrWhiteSpace(_connectionOptions.AuthToken))
            throw new InvalidOperationException("Auth Token requires a remote Turso URL Data Source.");
        if (!string.IsNullOrWhiteSpace(_connectionOptions.ReplicaPath))
            throw new InvalidOperationException("Replica Path requires a remote Turso URL Data Source.");
        if (_connectionOptions.SyncInterval > 0)
            throw new InvalidOperationException("Sync Interval requires a remote embedded replica connection.");
        if (_connectionOptions.Tls.HasValue)
            throw new InvalidOperationException("Tls requires a remote Turso URL Data Source.");
    }

    private void CloseRemote()
    {

View on GitHub (pinned to 244cde92a7)

Solutions

1. Remove 'Encryption Cipher' and 'Encryption Key' for remote connections — TLS secures the channel and the server handles encryption at rest
2. Keep encryption options only on local file connection strings
3. If you need a local encrypted database, use a file path Data Source where cipher plus key are honored

Example fix

// before
var cs = "Data Source=libsql://db.turso.io;Auth Token=...;Encryption Cipher=aes256;Encryption Key=a1b2...";

// after
var cs = "Data Source=libsql://db.turso.io;Auth Token=...";

var opts = TursoConnectionOptions.Parse(cs);
if (opts.IsRemote && (opts.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(opts["Encryption Key"])))
    throw new InvalidOperationException(
        "Remove encryption options: they only apply to local file databases.");

static bool EncryptionOptionsMatchMode(string cs)
{
    var opts = TursoConnectionOptions.Parse(cs);
    var hasEncryption = opts.GetEncryptionCipher().HasValue
        || !string.IsNullOrWhiteSpace(opts["Encryption Key"]);
    return opts.IsRemote ? !hasEncryption : true;
}

try { conn.Open(); }
catch (InvalidOperationException ex) when (ex.Message.Contains("Encryption Cipher and Encryption Key are local"))
{
    // strip Encryption Cipher/Encryption Key from the remote connection string and retry
}

When it happens

Trigger: Open() with 'Data Source=libsql://...;Encryption Cipher=aes256;Encryption Key=<hex>'; setting only 'Encryption Key' without a cipher on a remote URL; secrets managers injecting encryption keys into all connection strings uniformly.

Common situations: Security-hardened config templates applied to every environment; migrating an encrypted local database to Turso Cloud while keeping the keys in the string; copying between local and remote connection strings in appsettings.

Related errors

• No remote transaction is active on this connection.
• Embedded replica connections are not supported yet by the .N
• Sync Interval requires embedded replica support, which is no
• Auth Token requires a remote Turso URL Data Source.
• Replica Path requires a remote Turso URL Data Source.

AI-assisted analysis of tursodatabase/turso@244cde92a7 (2026-08-20). Data as JSON: /api/errors/e97241a99cd0f797. Report an issue: GitHub.