VictoriaMetrics/VictoriaMetrics · error

ApplicationCredentialSecret is empty

Error message

ApplicationCredentialSecret is empty

What it means

Thrown when application_credential_id is set but application_credential_secret is nil. Keystone's application_credential auth with an ID always requires the matching secret, so buildAuthRequestBody refuses to build a partial auth request. It is a config-completeness check, not a network failure.

Source

Thrown at lib/promscrape/discovery/openstack/auth.go:111

		Identity identityReq    `json:"identity"`
		Scope    map[string]any `json:"scope,omitempty"`
	}
	type request struct {
		Auth authReq `json:"auth"`
	}

	// Populate the request structure based on the provided arguments. Create and return an error
	// if insufficient or incompatible information is present.
	var req request

	if sdc.Password == nil {
		// There are three kinds of possible application_credential requests
		// 1. application_credential id + secret
		// 2. application_credential name + secret + user_id
		// 3. application_credential name + secret + username + domain_id / domain_name
		if len(sdc.ApplicationCredentialID) > 0 {
			if sdc.ApplicationCredentialSecret == nil {
				return nil, fmt.Errorf("ApplicationCredentialSecret is empty")
			}
			req.Auth.Identity.Methods = []string{"application_credential"}
			secret := sdc.ApplicationCredentialSecret.String()
			req.Auth.Identity.ApplicationCredential = &applicationCredentialReq{
				ID:     &sdc.ApplicationCredentialID,
				Secret: &secret,
			}
			return json.Marshal(req)
		}

		if sdc.ApplicationCredentialSecret == nil {
			return nil, fmt.Errorf("missing application_credential_secret when application_credential_name is set")
		}
		var userRequest *userReq
		if len(sdc.UserID) > 0 {
			// UserID could be used without the domain information
			userRequest = &userReq{
				ID: &sdc.UserID,

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Set application_credential_secret (or its file-based variant) alongside application_credential_id.
2. Verify the secret file exists and is readable by the VictoriaMetrics process if using a file provider.
3. If the credential has no secret, use password auth with username/user_id instead.

Example fix

# before
openstack_sd_configs:
  - application_credential_id: 8a7c3f...
# after
openstack_sd_configs:
  - application_credential_id: 8a7c3f...
    application_credential_secret: <secret>

if len(cfg.ApplicationCredentialID) > 0 && cfg.ApplicationCredentialSecret == nil {
    return fmt.Errorf("application_credential_id set but application_credential_secret is empty")
}

When it happens

Trigger: openstack_sd_config with application_credential_id set and password unset, but application_credential_secret omitted or empty. Raised from buildAuthRequestBody at SD config initialization.

Common situations: Secret stored in a file but the file provider block forgotten; secret rotation removed the entry; user assumed the ID alone identifies the credential.

Related errors

• password and application credentials are missing
• missing application_credential_secret when application_crede
• username and userid is empty
• domain_id and domain_name cannot be empty for application_cr
• username and userid is empty for username/password auth

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/e440c68ee375e831. Report an issue: GitHub.