windmill-labs/windmill · error

Failed to get workspace encryption key: ${err}

Error message

Failed to get workspace encryption key: ${err}

What it means

pushWorkspaceKey wraps the remote GET of the workspace encryption key; if that call fails (permissions, network, server error) the key comparison with the local value cannot happen, so the error is re-raised with the cause.

Source

Thrown at cli/src/core/settings.ts:455

  // When set it takes precedence over the prompt and the env var.
  skipReencrypt?: boolean;
}

export async function pushWorkspaceKey(
  workspace: string,
  _path: string,
  key: string | undefined,
  localKey: string,
  opts?: PushWorkspaceKeyOptions
) {
  try {
    key = await wmill
      .getWorkspaceEncryptionKey({
        workspace,
      })
      .then((r) => r.key);
  } catch (err) {
    throw new Error(`Failed to get workspace encryption key: ${err}`);
  }
  if (localKey && key !== localKey) {
    // Changing the key on the remote means the existing ciphertexts (encrypted
    // with the old key) become unreadable unless they are re-encrypted. By
    // default we ask the backend to re-encrypt every secret variable with the
    // new key, which preserves their plaintext values. The only reason to skip
    // re-encryption is when the stored ciphertexts are *already* encrypted with
    // the new key (e.g. a workspace/instance migration).
    let reencrypt: boolean;
    // Explicit choice via `--skip-reencrypt-on-key-change` or the env var wins
    // over everything, regardless of interactivity.
    const explicitSkip =
      opts?.skipReencrypt ||
      (process.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() ===
        "true";
    if (explicitSkip) {
      reencrypt = false;
      log.info(

View on GitHub (pinned to e474e8803c)

Solutions

1. Check the embedded error for 403 (admin rights required) vs network failure.
2. Retry after connectivity is restored.
3. Verify you are targeting the correct workspace.

When it happens

Trigger: Thrown at cli/src/core/settings.ts:455 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/49c11f8e78760350. Report an issue: GitHub.