dosubot[bot] commented on issue #38027: URL: https://github.com/apache/superset/issues/38027#issuecomment-3913561340
<!-- Greeting --> Hi @maclynnbrandlock! I'm [Dosu](https://go.dosu.dev/dosubot) and Iām helping the superset team. <!-- Answer --> The `Invalid decryption key` error indicates your current `SUPERSET_SECRET_KEY` doesn't match the key originally used to encrypt your database credentials. The migration `58d051681a3b_add_catalog_perm_to_tables` queries all database connections, which triggers decryption of the [encrypted password, encrypted_extra, and server_cert fields](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py#L129-L171). **If you have the original SECRET_KEY**, use the key rotation process: ```bash export PREVIOUS_SECRET_KEY=<your_old_key> export SUPERSET_SECRET_KEY=<your_new_key> superset re-encrypt-secrets superset db upgrade ``` **If you've lost the original key**, you'll need to clear the encrypted fields and re-enter credentials after migration: ```sql UPDATE dbs SET password = NULL, encrypted_extra = NULL; ``` Also ensure `SUPERSET_SECRET_KEY` is set correctly in your environment before running migrations ā this [environment variable takes precedence](https://github.com/apache/superset/discussions/36340) over config file settings. This is a [known issue when upgrading Superset](https://github.com/apache/superset/issues/32375), especially if the SECRET_KEY changed or wasn't consistently set across environments. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=hallucination) | [Report š](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6ed1c24d-fd0b-4d2d-bd0d-66118e139b89?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=The%20%60Invalid%20decryption%20key%60%20error%20indicates%20your%20current%20%60SUPERSET_SECRET_KEY%60%20doesn%27t%20match%20the%20key%20originally%20used%20to%20encrypt%20your%20database%20credentials.%20The%20migration%20%6058d051681a3b_add_catalog_perm_to_tables%60%20queries%20all%20database%20connections%2C%20which%20triggers%20decryption%20of%20the%20%5Bencrypted%20password%2C%20encrypted_extra%2C%20and%20server_cert%20fields%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py%23L129-L171%29.%0A%0A%2A%2AIf%20you%20have%20the%20original%20SECRET_KEY%2A%2A%2C%20use%20the%20key%20rotation%20process%3A%0A%60%60%60bash%0Aexport%20PREVIOUS_SECRET_KEY%3D%3Cyour_old_key%3E%0Aexport%20SUPERSE T_SECRET_KEY%3D%3Cyour_new_key%3E%0Asuperset%20re-encrypt-secrets%0Asuperset%20db%20upgrade%0A%60%60%60%0A%0A%2A%2AIf%20you%27ve%20lost%20the%20original%20key%2A%2A%2C%20you%27ll%20need%20to%20clear%20the%20encrypted%20fields%20and%20re-enter%20credentials%20after%20migration%3A%0A%60%60%60sql%0AUPDATE%20dbs%20SET%20password%20%3D%20NULL%2C%20encrypted_extra%20%3D%20NULL%3B%0A%60%60%60%0A%0AAlso%20ensure%20%60SUPERSET_SECRET_KEY%60%20is%20set%20correctly%20in%20your%20environment%20before%20running%20migrations%20%E2%80%94%20this%20%5Benvironment%20variable%20takes%20precedence%5D%28https%3A//github.com/apache/superset/discussions/36340%29%20over%20config%20file%20settings.%0A%0AThis%20is%20a%20%5Bknown%20issue%20when%20upgrading%20Superset%5D%28https%3A//github.com/apache/superset/issues/32375%29%2C%20especially%20if%20the%20SECRET_KEY%20changed%20or%20wasn%27t%20consistently%20set%20across%20environments.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/38027) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
