alibaba/nacos · critical · NacosRuntimeException

400

400

Error message

Please config `nacos.plugin.auth.nacos.token.secret.key`, detail see https://nacos.io/docs/latest/manual/admin/auth/

What it means

JwtTokenManager builds its parser only if a secret key was supplied at construction; with a blank key jwtParser stays null and checkJwtParser() throws NacosRuntimeException(INVALID_PARAM=400). Auth is enabled (the code path that calls checkJwtParser only runs when auth is on) but the operator never set nacos.plugin.auth.nacos.token.secret.key, so the server cannot sign or verify any JWT. This is a fatal misconfiguration surfaced to the caller as a 400.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/token/impl/JwtTokenManager.java:141

        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {
            return getTokenValidityInSeconds();
        }
        checkJwtParser();
        return jwtParser.getExpireTimeInSeconds(token)
            - TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis());
    }
    
    public long getExpiredTimeInSeconds(String token) throws AccessException {
        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {
            return getTokenValidityInSeconds();
        }
        checkJwtParser();
        return jwtParser.getExpireTimeInSeconds(token);
    }
    
    private void checkJwtParser() {
        if (jwtParser == null) {
            throw new NacosRuntimeException(NacosException.INVALID_PARAM,
                "Please config `nacos.plugin.auth.nacos.token.secret.key`, detail see "
                    + "https://nacos.io/docs/latest/manual/admin/auth/");
        }
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

Set nacos.plugin.auth.nacos.token.secret.key to a Base64 string of at least 32 bytes in application.properties of every node.
Restart the node after setting the key so JwtTokenManager reconstructs the parser.
Ensure all cluster members share the same secret key.
Re-disable auth (nacos.core.auth.enabled=false) only if you intend to run without auth.

Example fix

# before (auth on, no key)
# application.properties
nacos.core.auth.enabled=true
# nacos.plugin.auth.nacos.token.secret.key is unset -> 400

# after
nacos.core.auth.enabled=true
nacos.plugin.auth.nacos.token.secret.key=VGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg5
# then restart all nodes

Defensive patterns

Strategy: validation

Validate before calling

// At startup, refuse to enable auth unless a secret key is configured.
import com.alibaba.nacos.common.utils.StringUtils;
import org.springframework.core.env.Environment;

String key = env.getProperty("nacos.plugin.auth.nacos.token.secret.key", "");
boolean authEnabled = Boolean.parseBoolean(env.getProperty("nacos.core.auth.enabled", "false"));
if (authEnabled && StringUtils.isBlank(key)) {
    throw new IllegalStateException(
        "nacos.core.auth.enabled=true but nacos.plugin.auth.nacos.token.secret.key is blank");
}
byte[] decoded = java.util.Base64.getDecoder().decode(key);
if (decoded.length < 32) {
    throw new IllegalStateException("token secret key must decode to >= 32 bytes");
}

Try / catch

try {
    tokenManager.parseToken(token);
} catch (NacosRuntimeException e) {
    if (e.getErrCode() == NacosException.INVALID_PARAM
            && e.getMessage().contains("token.secret.key")) {
        // fatal misconfiguration -> fail startup, do not serve requests
        throw new IllegalStateException("auth enabled without a token secret key", e);
    }
    throw e;
}

Prevention

Always set nacos.plugin.auth.nacos.token.secret.key when enabling auth.
Validate the key is a Base64 string decoding to >= 32 bytes.
Use the same key on every cluster member.
Add a startup guard so the server fails fast rather than at first request.

When it happens

Trigger: Enabling nacos.core.auth.enabled=true (or setting system type) without configuring nacos.plugin.auth.nacos.token.secret.key, then performing any login, token validation, or authed config/naming request. Also createToken() when authEnabled but jwtParser is null.

Common situations: First-time auth enablement where the secret-key step was skipped; key left blank because it is optional while auth is off, then auth turned on; secret key copied from a template without being set.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/bc43808d228a26ab. Report an issue: GitHub.