Could not decrypt: wrong key or tampered ciphertext

Decryption failed, and the message deliberately does not tell you which of the two possible reasons applies.

Why the message is vague on purpose

The comment above the throw says it plainly: wrong key and tampered payload are indistinguishable here, deliberately — telling them apart would be an oracle.

An attacker who can submit ciphertext and learn "your key is wrong" versus "the payload was modified" has a probe. Repeated often enough, that distinction leaks information about the key or lets them confirm which byte they altered. So both paths collapse into one error with one message.

This is a case where a less helpful error is the correct engineering decision, and it is worth knowing that before filing it as a usability bug.

What actually causes it

Wrong key. The #k= fragment came from a different session, or the session was re-keyed after your link was issued. Re-keying is revocation — old links stop working immediately, which is the intended behaviour.

Tampered or truncated ciphertext. Something modified the payload in transit or at rest. AES-GCM is authenticated, so it throws rather than returning plausible garbage. A cipher without authentication would hand you corrupted plaintext and let you act on it.

How to fix it

Confirm you are using the newest link for that session — if it was re-keyed, ask for a fresh one. If the link is current and this persists, the payload itself is damaged, which is a transport or storage problem rather than a key problem.

If the fragment is missing entirely rather than wrong, that surfaces as a different error before decryption is attempted.