alibaba/spring-ai-alibaba · critical · IllegalArgumentException

oss ak or sk should be set.

Error message

oss ak or sk should be set.

What it means

OssManager.afterPropertiesSet (a Spring InitializingBean callback) validates OSS configuration at bean startup and throws IllegalArgumentException('oss ak or sk should be set.') when the access key id or secret from properties.getOss() is blank. This fails application startup because the OSS client cannot be built without credentials.

Source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/manager/OssManager.java:277

		}
		finally {
			IOUtils.closeQuietly(is);
			IOUtils.closeQuietly(bos);
			IOUtils.closeQuietly(ossObject);
		}
	}

	@Override
	public void afterPropertiesSet() {
		if (!Objects.equals(properties.getUploadMethod(), UploadType.OSS.getValue())) {
			return;
		}

		String ak = properties.getOss().getAccessKeyId();
		String sk = properties.getOss().getAccessKeySecret();
		String region = properties.getOss().getRegion();
		if (StringUtils.isBlank(ak) || StringUtils.isBlank(sk)) {
			throw new IllegalArgumentException("oss ak or sk should be set.");
		}

		credentialsProvider = new DefaultCredentialProvider(ak, sk);

		// this is for public access like
		ossClient = OSSClientBuilder.create()
			.endpoint(properties.getOss().getEndpoint())
			.credentialsProvider(credentialsProvider)
			.region(region)
			.build();

		// This is for vpc internet access
		ossClientInternal = OSSClientBuilder.create()
			.endpoint(properties.getOss().getInternalEndpoint())
			.credentialsProvider(credentialsProvider)
			.region(region)
			.build();
	}

View on GitHub (pinned to f82da0b50f)

Solutions

1. Set the OSS accessKeyId and accessKeySecret in your configuration (YAML properties oss.access-key-id / oss.access-key-secret)
2. Ensure the backing environment variables or secrets are actually injected into the runtime environment
3. Check that the active Spring profile/config source includes the oss block
4. Validate at deploy time with a startup config check to fail fast with a clear message

Example fix

// before (application.yml)
spring:
  ai:
    alibaba:
      studio:
        oss:
          region: cn-beijing
// after
spring:
  ai:
    alibaba:
      studio:
        oss:
          region: cn-beijing
          access-key-id: ${OSS_ACCESS_KEY_ID}
          access-key-secret: ${OSS_ACCESS_KEY_SECRET}

// fail fast before Spring context starts
OssProperties oss = props.getOss();
if (oss.getAccessKeyId() == null || oss.getAccessKeyId().isBlank()
    || oss.getAccessKeySecret() == null || oss.getAccessKeySecret().isBlank()) {
    throw new IllegalStateException("Set oss.access-key-id and oss.access-key-secret");
}

boolean ossCredentialsPresent(OssProperties oss) {
    return oss != null && oss.getOss() != null
        && notBlank(oss.getOss().getAccessKeyId())
        && notBlank(oss.getOss().getAccessKeySecret());
}

try {
    applicationContext.refresh(); // or startup path that builds OssManager
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("oss ak or sk should be set")) {
        System.err.println("FATAL: OSS credentials missing; set OSS_ACCESS_KEY_ID/OSS_ACCESS_KEY_SECRET");
        System.exit(1);
    }
    throw e;
}

When it happens

Trigger: Application startup with spring-ai-alibaba studio config where oss.access-key-id or oss.access-key-secret is unset, empty, or only whitespace (e.g. env var not injected, YAML key misspelled, profile not activated).

Common situations: Deploying without the secret injected by the secret manager; renaming env vars so placeholders resolve to empty; running locally without application-local.yml; config server not returning the oss block.

Related errors

• oss bucket should be set.
• 创建RestClient失败
• OSS_UPLOAD_ERROR
• OSS_DOWNLOAD_ERROR
• oss object name is invalid

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/268c7e3a0f8ff9e8. Report an issue: GitHub.