alibaba/nacos · critical · NacosRuntimeException

50002

50002

Error message

Empty identity, Please set `nacos.core.auth.server.identity.key` and `nacos.core.auth.server.identity.value`, detail: https://nacos.io/docs/latest/manual/admin/auth/

What it means

Thrown by NacosServerAuthConfig.validate() (OPEN_API auth scope) when auth is enabled and type is set, but server identity key or value is empty. Identical logic to the admin-scope variant (1035) but for the OPEN_API scope. Error code 50002 (AuthErrorCode.EMPTY_IDENTITY). Both nacos.core.auth.server.identity.key and .value must be non-empty.

Source

Thrown at core/src/main/java/com/alibaba/nacos/core/auth/NacosServerAuthConfig.java:73

    public NacosServerAuthConfig() {
        super("NacosServerAuth");
        resetConfig();
        validate();
    }
    
    /**
     * Validate auth config.
     */
    private void validate() {
        if (!authEnabled) {
            return;
        }
        if (StringUtils.isEmpty(nacosAuthSystemType)) {
            throw new NacosRuntimeException(AuthErrorCode.INVALID_TYPE.getCode(),
                AuthErrorCode.INVALID_TYPE.getMsg());
        }
        if (StringUtils.isEmpty(serverIdentityKey) || StringUtils.isEmpty(serverIdentityValue)) {
            throw new NacosRuntimeException(AuthErrorCode.EMPTY_IDENTITY.getCode(),
                AuthErrorCode.EMPTY_IDENTITY.getMsg());
        }
    }
    
    @Override
    public String getAuthScope() {
        return NACOS_SERVER_AUTH_SCOPE;
    }
    
    /**
     * server auth function is open.
     *
     * @return server auth function is open
     */
    @Override
    public boolean isAuthEnabled() {
        return authEnabled;
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

Set both nacos.core.auth.server.identity.key and nacos.core.auth.server.identity.value to non-empty identical values cluster-wide.
Use a strong unique secret, not the default.
Restart after applying the config.

Example fix

# before (broken)
nacos.core.auth.enabled=true
nacos.plugin.auth.type=nacos
# (no identity)

# after (fixed)
nacos.core.auth.enabled=true
nacos.plugin.auth.type=nacos
nacos.core.auth.server.identity.key=serverIdentity
nacos.core.auth.server.identity.value=<strong-unique-secret>

Defensive patterns

Strategy: validation

Validate before calling

# Same identity pre-flight as 1035
if grep -q 'nacos.core.auth.enabled=true' application.properties; then
  KEY=$(grep -oP 'nacos.core.auth.server.identity.key=\K.*' application.properties)
  VAL=$(grep -oP 'nacos.core.auth.server.identity.value=\K.*' application.properties)
  if [ -z "$KEY" ] || [ -z "$VAL" ]; then
    echo 'ERROR: server identity key/value must both be set when auth is enabled'; exit 1;
  fi
fi

Prevention

Set both identity key and value cluster-wide (covers OPEN_API scope).
Use a strong unique secret shared across nodes.
Add a deployment pre-flight check for the identity pair.
Avoid the default identity value in production.

When it happens

Trigger: Auth enabled with a type, but the server identity key/value pair is missing or partially set, validated by the OPEN_API-scope config. Applies to client/Open API auth scope. Thrown at config validation (startup or dynamic reset).

Common situations: Same as 1035: identity pair forgotten, only key or only value set, cluster nodes mismatched. Template/deployment artifact missing the identity lines.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/60ff5949557670f5. Report an issue: GitHub.