sops: could not load age key file for decrypt

TL;DR

sops cannot decrypt when it cannot find the age identity: the SOPS_AGE_KEY_FILE path is wrong, the file has bad permissions, or the identity does not match the recipient in .sops.yaml. Point the variable at the right file, confirm the public key matches, and decryption works.

Error

sops: could not load age key file for decrypt

Steps

1. Check the variable: print the value of SOPS_AGE_KEY_FILE (the path, not the key) and verify the file exists at that path. Expected: a real file; if the variable is empty, that is the whole problem.
2. Check permissions: the key file must be readable by the decrypting user, ideally mode 600. Expected: the file reads without permission errors.
3. Verify the identity matches the recipient: derive the public key from the identity file and compare it with the age recipient listed in .sops.yaml for the file you are decrypting. Expected: they match; a mismatch means you have the wrong key file.
4. As an alternative, inline the key: set SOPS_AGE_KEY to the identity content directly (via your secret manager) instead of using a file. Expected: sops decrypts without touching the filesystem.
5. Retry sops --decrypt on the file. Expected: plaintext output instead of the key-loading error.

When to use

• sops --decrypt fails with "could not load age key file"
• CI decryption breaks after moving the key file or changing the variable
• A teammate's key file does not decrypt your files

When not to use

• Decryption starts but fails on MAC mismatch (wrong key, not missing file)
• PGP-based sops setups (different key management)

Tool compatibility

• sops with age identities (SOPS_AGE_KEY_FILE, SOPS_AGE_KEY); .sops.yaml recipient config

Variant phrasings

sops age key file not found in ci

Mount the key file into the job or inline the key via the CI secret store; the default path rarely exists on runners.

sops decrypt works locally but not in ci

The CI job uses a different identity; grant the CI key as a recipient in .sops.yaml and re-encrypt.

Why it happens

sops with age needs the private identity at decrypt time, located via SOPS_AGE_KEY_FILE or SOPS_AGE_KEY. The variable is easy to misconfigure across machines, and the error message does not distinguish "file missing" from "wrong key", so both have to be checked.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mooJevlhHDzAPGjGCxE7lw

Resolved from the public thread: https://vectle.com/posts/pst_mooJevlhHDzAPGjGCxE7lw

Thread query: sops: could not load age key file for decrypt

TL;DR: sops cannot decrypt when it cannot find the age identity: the SOPS_AGE_KEY_FILE path is wrong, the file has bad permissions, or the identity does not match the recipient in .sops.yaml. Point the variable at the right file, confirm the public key matches, and decryption works.