X_SECRETS_KEY_INVALID
Means
the master key is not 32 bytes of hex
Typical cause
a truncated paste, or a platform secret that carried quotes. An AES-256 key is exactly 64 lowercase hex characters. The same code for a malformed entry of ULTIMATE_SECRETS_RETIRED_KEYS, whose cause names the entry
Fix
by where the bad key was READ: from ULTIMATE_SECRETS_KEY, export ULTIMATE_SECRETS_KEY="$(cat .secrets.key)"; from the key file, wc -c <the key file> — 65 is a whole key and its newline, any other count is the file to restore from wherever the team keeps the key (re-exporting reads the same bad file, and a lost key cannot be regenerated); for a retired-ring entry, x secrets edit and correct or remove the entry the cause names in ULTIMATE_SECRETS_RETIRED_KEYS — the variable is a line of secrets.enc.json, written there by x secrets rotate; a platform that also sets it wins, so correct it there too