The credentials vault has no encryption key on the server

Symptom

When you save a credential in the vault, the Invalid Operation window opens and the credential is not saved. The cause is not your profile, but the server fiscaldoo runs on.

Message

Copied from the Portuguese demo database, when clicking Save on a new credential (Accounting › Configure › Credentials vault › Credentials), with the Administrator profile. There are three forms:

• The server has no key:

  “This server has no encryption key for the credentials vault, so nothing was saved and nothing was revealed. Ask the system administrator to set the environment variable FISCALDOO_SECRETS_KEY (or FISCALDOO_SECRETS_KEY_PATH, a file with permissions 600) outside the database.”

• The key file is open to other users on the server:

  “The encryption key file of the credentials vault is readable by other users. Set its permissions to 600 and try again.”

• The path given does not exist or the file cannot be read:

  “The encryption key file of the credentials vault cannot be read. Check the path and the permissions of the file.”

In every case nothing was saved, and the credentials screen still opens.

Verified causes

The vault encrypts each password with a key that is never in the database or the repository. The server reads it from an environment variable (FISCALDOO_SECRETS_KEY) or from a single-owner file, with permissions 600, given by FISCALDOO_SECRETS_KEY_PATH. The message changes depending on what is missing: neither of the two, a file readable by others, or a file that cannot be found.

What to check

1. Which of the three sentences appears: it says what is missing.
2. Who administers the server. This fix is not made in fiscaldoo.

How to fix it

Who does it: the server administrator (not fiscaldoo users).

1. If the sentence says “has no encryption key”: set the FISCALDOO_SECRETS_KEY variable, or create a file with the key and give its path in FISCALDOO_SECRETS_KEY_PATH. The key is a random sequence of 32 bytes, encoded in URL-safe base64 (44 characters), on a single line. If the key exists but does not have that format, the sentence is “The encryption key of the credentials vault is not valid: it must be 32 random bytes in URL-safe base64 (44 characters)…”.
2. If the sentence says “is readable by other users”: set the file to 600 (chmod 600) and check that it belongs to the user running Odoo.
3. If the sentence says “cannot be read”: check the file's path and owner.
4. Restart the Odoo service, so that the server reads the key again, and save the credential again.
5. Keep a copy of the key in a safe place, outside the database and outside the repository.

Do not put the key in an e-mail, a support message or the database itself.

Expected result

The credential is saved, the Has a secret field becomes active and the Reveal secret button appears, for those with the permission (I do not have permission to view, use or change a vault credential).

When to contact support

• The key is set, the file has permissions 600 and the service has been restarted, and the same sentence appears.

Information to send

Follow How to ask support for help and what information to send, with the full sentence of the message. Never send the content of the key.