alibaba/nacos · critical · IllegalArgumentException

the length of secret key must great than or equal 32 bytes;

Error message

the length of secret key must great than or equal 32 bytes; And the secret key must be encoded by base64. Please see https://nacos.io/docs/latest/manual/admin/auth/

What it means

Thrown by validateTokenSecret() in NacosAuthPluginConfig when token.secret.key is non-blank but fails to construct a NacosJwtParser — meaning the key is not valid base64 or decodes to fewer than 32 bytes. The original RuntimeException is wrapped in an IllegalArgumentException carrying the INVALID_SECRET_MESSAGE constant.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/configuration/NacosAuthPluginConfig.java:148

        }
    }
    
    private static boolean parseBoolean(String value, String key) {
        if (!Boolean.TRUE.toString().equalsIgnoreCase(value)
            && !Boolean.FALSE.toString().equalsIgnoreCase(value)) {
            throw new IllegalArgumentException("Plugin config value is not a boolean: " + key);
        }
        return Boolean.parseBoolean(value);
    }
    
    private static void validateTokenSecret(String tokenSecretKey) {
        if (StringUtils.isBlank(tokenSecretKey)) {
            return;
        }
        try {
            new NacosJwtParser(tokenSecretKey);
        } catch (RuntimeException e) {
            throw new IllegalArgumentException(INVALID_SECRET_MESSAGE, e);
        }
    }
    
    public String getTokenSecretKey() {
        return tokenSecretKey;
    }
    
    public long getTokenExpireSeconds() {
        return tokenExpireSeconds;
    }
    
    public boolean isTokenCacheEnabled() {
        return tokenCacheEnabled;
    }
    
    public boolean isCachingEnabled() {
        return cachingEnabled;
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

Generate a proper key: openssl rand -base64 64 (guarantees >= 32 decoded bytes and valid base64).
Ensure the key has no leading/trailing whitespace or newlines when placed in the config file.
Verify the key decodes to >= 32 bytes before deploy (echo -n "$KEY" | base64 -d | wc -c).

Example fix

// before
nacos.core.auth.plugin.nacos.token.secret.key=mysecret

// after (generate: openssl rand -base64 64)
nacos.core.auth.plugin.nacos.token.secret.key=VGhpcyBpcyBhIHZlcnkgbG9uZyBiYXNlNjQgc2VjcmV0IGtleSB0aGF0IGlzIDMyKyBieXRl cw==

Defensive patterns

Strategy: validation

Validate before calling

String key = config.get(NacosAuthPluginConfig.TOKEN_SECRET_KEY);
if (StringUtils.isNotBlank(key)) {
    byte[] decoded = java.util.Base64.getDecoder().decode(key);
    if (decoded.length < 32) {
        throw new IllegalArgumentException(
            "token.secret.key decodes to " + decoded.length + " bytes; minimum is 32");
    }
}

Try / catch

try {
    NacosAuthPluginConfig.from(config, authEnabled);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("secret key must great than")) {
        log.error("token.secret.key invalid: must be base64 decoding to >= 32 bytes");
    }
    throw e;
}

Prevention

Generate keys with openssl rand -base64 64 and verify decode length >= 32 bytes.
Trim whitespace/newlines from the key before storing it in config.
Centralize key generation so no hand-typed keys reach production.

When it happens

Trigger: token.secret.key is set to a plain-text string shorter than 32 bytes, or to a value that is not valid base64; new NacosJwtParser(tokenSecretKey) throws and the catch (RuntimeException) rethrows with the descriptive message.

Common situations: Using a short human-readable password as the secret key; pasting a key with embedded newlines or spaces that break base64; generating a key with the wrong tool (e.g., a hex string instead of base64).

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/accb6955c4f53789. Report an issue: GitHub.