diff --git a/cli/pkg/secrets/key_holder.go b/cli/pkg/secrets/key_holder.go
index 37133606b7..f399b41367 100644
--- a/cli/pkg/secrets/key_holder.go
+++ b/cli/pkg/secrets/key_holder.go
@@ -18,6 +18,9 @@ type KeyHolder struct {
 }
 
 func NewKeyHolder(deviceKey []byte) *KeyHolder {
+	if len(deviceKey) != 32 {
+		panic(fmt.Sprintf("device key must be 32 bytes, found: %d bytes", len(deviceKey)))
+	}
 	return &KeyHolder{
 		AccountSecrets: make(map[string]*model.AccSecretInfo),
 		CollectionKeys: make(map[string][]byte),