Key is not the correct length or format

Key is not the correct length or format

TL;DR: the key value in your config is not a valid WireGuard key. The two classic causes are a placeholder like CHANGEME left in the file, and pasting the key file's path instead of the key itself. Generate a real key with wg genkey and paste the key value (not the path) into the config.

Key is not the correct length or format

Steps

1. Generate a fresh keypair:

wg genkey | tee privatekey | wg pubkey > publickey

Expected: two files, each holding one 44-character base64 line.

2. Open the config and replace the bad value with the actual key contents:

PrivateKey [your private key value]

Not the path to the file. The config wants the key itself.

3. Do the same for the peer's PublicKey, using the contents of the publickey file.
4. Bring the interface up:

sudo wg-quick up wg0

Expected: no key error, and wg show displays the interface.

When this applies

• configs copied from a template with placeholder keys still in place
• the config contains something like /etc/wireguard/privatekey where the key should be
• keys truncated by an editor or wrapped across lines

When it doesnt

• handshake never completes with valid keys — that is endpoints or firewall
• RTNETLINK errors — address problems, not keys
• the key parses but the peer rejects — check you shared the public half

Compatibility

wireguard-tools on Linux, macOS, Windows; any config with PrivateKey/PublicKey.

Other phrasings

• wireguard invalid key format
• wg setconf key length

Why it happens

WireGuard keys are 32 raw bytes shown as 44 base64 characters. Anything else — a path, a placeholder word, a wrapped line — fails the length check before any crypto happens.

Edge cases

• wg genkey output includes a trailing newline; strip it when pasting.
• Keep private keys at 600 permissions; the error is about format, but leaked keys are worse.
• The Arch wiki documents this exact mistake: the config needs the key value, not the filename.