HSX_E_TOKEN_KEY_CUSTODY_CORRUPT

01 · Meaning

What this error means

The custody entry exists but cannot be decrypted, or the key it holds does not open the binding’s sealed canary — it is not the key the deployed Worker encrypts OAuth blobs with. Nothing was mutated.

When this error stops a command, hs-x exits with code 1. With --json, the failure is reported as a structured error whose code field is HSX_E_TOKEN_KEY_CUSTODY_CORRUPT — stable to match on in scripts and agents.

02 · Causes

Likely causes

• The custody store and its master key file were restored from different backups
• The custody file was hand-edited or truncated
• The binding record was overwritten to point at a different deployment’s key

03 · Fix

How to fix it

• Restore token-key-custody.json AND token-key-custody.key from the SAME backup
• If no consistent backup exists, treat this as a lost key: see HSX_E_TOKEN_KEY_CUSTODY_MISSING and docs/token-key-custody.md

Still stuck? Re-run the command with --debug for the wire-level detail, or hs-x doctor to check accounts, link state, and connectivity in one pass.