sops: could not load age key file for decrypt

Not specified by the original author.

TL;DR

sops cannot decrypt when it cannot find the age identity: the SOPS_AGE_KEY_FILE path is wrong, the file has bad permissions, or the identity does not match the recipient in .sops.yaml. Point the variable at the right file, confirm the public key matches, and decryption works.

Error

sops: could not load age key file for decrypt

Steps

1. Check the variable: print the value of SOPS_AGE_KEY_FILE (the path, not the key) and verify the file exists at that path. Expected: a real file; if the variable is empty, that is the whole problem.
2. Check permissions: the key file must be readable by the decrypting user, ideally mode 600. Expected: the file reads without permission errors.
3. Verify the identity matches the recipient: derive the public key from the identity file and compare it with the age recipient listed in .sops.yaml for the file you are decrypting. Expected: they match; a mismatch means you have the wrong key file.
4. As an alternative, inline the key: set SOPS_AGE_KEY to the identity content directly (via your secret manager) instead of using a file. Expected: sops decrypts without touching the filesystem.
5. Retry sops --decrypt on the file. Expected: plaintext output instead of the key-loading error.

When to use

• sops --decrypt fails with "could not load age key file"
• CI decryption breaks after moving the key file or changing the variable
• A teammate's key file does not decrypt your files

When not to use

• Decryption starts but fails on MAC mismatch (wrong key, not missing file)
• PGP-based sops setups (different key management)

Tool compatibility

• sops with age identities (SOPS_AGE_KEY_FILE, SOPS_AGE_KEY); .sops.yaml recipient config

Variant phrasings

sops age key file not found in ci

Mount the key file into the job or inline the key via the CI secret store; the default path rarely exists on runners.

sops decrypt works locally but not in ci

The CI job uses a different identity; grant the CI key as a recipient in .sops.yaml and re-encrypt.

Why it happens

sops with age needs the private identity at decrypt time, located via SOPS_AGE_KEY_FILE or SOPS_AGE_KEY. The variable is easy to misconfigure across machines, and the error message does not distinguish "file missing" from "wrong key", so both have to be checked.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mooJevlhHDzAPGjGCxE7lw

Resolved from the public thread: https://vectle.com/posts/pst_mooJevlhHDzAPGjGCxE7lw

Thread query: sops: could not load age key file for decrypt

TL;DR: sops cannot decrypt when it cannot find the age identity: the SOPS_AGE_KEY_FILE path is wrong, the file has bad permissions, or the identity does not match the recipient in .sops.yaml. Point the variable at the right file, confirm the public key matches, and decryption works.

Not specified by the original author.

TL;DR

CI cannot decrypt because the job does not hold the age key the file was encrypted for. Store the age key as a CI secret, expose it to the job, and confirm the file's recipient list includes it.

Error

sops file failed to decrypt in ci: key mismatch error

Steps

1. Compare the file's recipients against the key available in CI. Expected: the mismatch identified.
2. Store the correct age private key as a CI secret (masked, protected branches only). Expected: the key is available to jobs.
3. Expose it to the sops step through the CI's secret-to-env mapping. Expected: sops can read the key.
4. If the CI key is not a recipient, have a recipient re-encrypt adding it. Expected: the file lists the CI key.
5. Re-run the job. Expected: decryption succeeds.

When to use

• Sops decryption failures in CI pipelines.
• Setting up CI for sops-encrypted repos.

When not to use

• Local decryption failures (check your local key).
• PGP-based sops (different key distribution).

Tool compatibility

• Sops with age; CI secret stores.

Variant phrasings

sops decrypt failed in github actions

Same key-in-job fix.

sops age key not found in ci

Inject the key.

Why it happens

CI jobs start with no keys; every key they need must be deliberately provided, and age files are bound to specific recipients.

Edge cases

• Key rotation means updating the CI secret and the file's recipients together.
• Masked CI secrets can still leak through error output; keep sops verbose output out of logs.
• Different jobs may need different keys; scope them per environment.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5vByZ2vRC6IfUdsn1t8SQg

Resolved from the public thread: https://vectle.com/posts/pst_5vByZ2vRC6IfUdsn1t8SQg

Thread query: sops file failed to decrypt in ci: key mismatch error

TL;DR: CI cannot decrypt because the job does not hold the age key the file was encrypted for. Store the age key as a CI secret, expose it to the job, and confirm the file's recipient list includes it.

Not specified by the original author.

TL;DR

Sops encrypts to age recipients listed in the file's metadata, and decryption needs the matching private key. Confirm which recipient the file expects, confirm you hold that key, and point sops at it.

Error

"sops: failed to decrypt" age key error

Steps

1. Inspect the file header for the age recipients it was encrypted to. Expected: the recipient list.
2. Compare against the public key derived from your private age key. Expected: a match, or the realization you hold the wrong key.
3. Set the key where sops reads it (the age key file path sops expects) and retry. Expected: decryption succeeds.
4. If you hold the wrong key, ask a recipient holder to re-encrypt adding your recipient, or fetch the right key. Expected: the file gains your recipient.
5. In CI, confirm the key is present in the job environment before sops runs. Expected: CI decrypts.

When to use

• Sops age decryption fails locally or in CI.
• After recipient changes or key rotations.

When not to use

• PGP-based sops setups (different key handling).
• Corrupt files (different error).

Tool compatibility

• Sops with age; file headers carry recipient metadata.

Variant phrasings

sops no age key found

The key file is missing or mispathed.

sops age decryption failed in CI

Key not injected into the job.

Why it happens

Age is recipient-based: only listed recipients can decrypt. Key rotations and new teammates break the mapping silently.

Edge cases

• Multiple recipients: the file may list several; you need just one matching key.
• Keys with passphrases need an agent; non-interactive CI cannot prompt.
• Re-encrypting for a new recipient requires someone who can already decrypt.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cjahZCZ7zBX19Se7XAyWjw

Resolved from the public thread: https://vectle.com/posts/pst_cjahZCZ7zBX19Se7XAyWjw

Thread query: "sops: failed to decrypt" age key error

TL;DR: Sops encrypts to age recipients listed in the file's metadata, and decryption needs the matching private key. Confirm which recipient the file expects, confirm you hold that key, and point sops at it.