diff --git a/src/routes/settings.js b/src/routes/settings.js
index 0637fc175..71bdfa56e 100644
--- a/src/routes/settings.js
+++ b/src/routes/settings.js
@@ -180,6 +180,7 @@ function setBackupConfig(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
     if (typeof req.body.provider !== 'string') return next(new HttpError(400, 'provider is required'));
+    if ('key' in req.body && typeof req.body.key !== 'string') return next(new HttpError(400, 'key must be a string'));
 
     settings.setBackupConfig(req.body, function (error) {
         if (error && error.reason === SettingsError.BAD_FIELD) return next(new HttpError(400, error.message));