No encryption key found, skipping encryption. Recommend…

Error message

No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY

What it means

processInstanceSettings only encrypts/decrypts sensitive settings (license_key, jwt_secret, oauth secrets) when the WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY environment variable is set. When it is absent, encryption is skipped entirely: settings are written/pushed/read as-is and this warning is printed. This is dangerous on push because secrets would be stored or sent in plaintext, and on pull because encrypted remote values cannot be decrypted.

Solutions

Export the key before running the command: export WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY=<key> (the same key the instance uses).
Store the key in CI secrets and inject it into the environment for sync jobs.
Verify it is visible to the CLI process (printenv WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY) — shell rc files may not run in non-interactive shells.
Re-run `wmill settings pull` after setting the key so local files hold properly encrypted values.

Example fix

// before
wmill settings push
// Warning: No encryption key found, skipping encryption...

// after
export WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY="$(op read op://vault/wmill/enc-key)"
wmill settings push

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY) {
  throw new Error("WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY must be set before wmill settings pull/push");
}

Try / catch

const key = process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
if (!key) {
  console.error("refusing to sync instance settings without WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY (secrets would be plaintext)");
  process.exit(1);
}

Prevention

Set WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY in every environment (shell rc, CI secrets, container env) that runs settings sync
Treat the warning as a hard stop in CI: fail the job if the key is absent
Never push instance settings with encryption skipped — license_key and jwt_secret would go plaintext
Use the same key value the Windmill instance uses

When it happens

Trigger: Any call to processInstanceSettings (via pullInstanceSettings or pushInstanceSettings) in a shell where the WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY environment variable is unset or empty.

Common situations: Running `wmill settings push` in CI without exporting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY; running the CLI in a fresh terminal where only WMILL_TOKEN/WMILL_REMOTE are set; forgetting the key after moving to a new machine.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/3a3b7b3c93c500ee. Report an issue: GitHub.

Appendix: source

Thrown at cli/src/core/settings.ts:552

        );
      } else if (s.name == "oauths") {
        if (typeof s.value === "object") {
          const oauths = s.value as { [key: string]: any };
          for (const [k, v] of Object.entries(oauths)) {
            oauths[k] = await processField(v, "secret", encKey, mode);
          }
          res.push(s);
        } else {
          log.warn(`Unexpected oauths value type: ${typeof s.value}`);
          res.push(s);
        }
      } else {
        res.push(s);
      }
    }
    return res;
  } else {
    log.warn(
      "No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY"
    );
  }
  return settings;
}

async function processField(
  obj: { [key: string]: any },
  field: string,
  encKey: string,
  mode: "encode" | "decode"
): Promise<{ [key: string]: any }> {
  return {
    ...obj,
    [field]:
      mode === "encode"
        ? await encrypt(obj[field], encKey)
        : ((await decrypt(obj[field], encKey)) as any),

View on GitHub (pinned to e474e8803c)