# X_SECRETS_KEY_INVALID

## Means

the master key is not 32 bytes of hex

## Typical cause

a truncated paste, or a platform secret that carried quotes. An AES-256 key is exactly 64 lowercase hex characters. The same code for a malformed entry of `ULTIMATE_SECRETS_RETIRED_KEYS`, whose cause names the entry

## Fix

by where the bad key was READ: from `ULTIMATE_SECRETS_KEY`, `export ULTIMATE_SECRETS_KEY="$(cat .secrets.key)"`; from the key file, `wc -c <the key file>` — 65 is a whole key and its newline, any other count is the file to restore from wherever the team keeps the key (re-exporting reads the same bad file, and a lost key cannot be regenerated); for a retired-ring entry, `x secrets edit` and correct or remove the entry the cause names in `ULTIMATE_SECRETS_RETIRED_KEYS` — the variable is a line of `secrets.enc.json`, written there by `x secrets rotate`; a platform that also sets it wins, so correct it there too

[Encrypted secrets](/error-codes#encrypted-secrets)