apache/druid · error · ParseException

Failed to authenticate to schema registry for Avro schema id

Error message

Failed to authenticate to schema registry for Avro schema id[%s]. Please check your credentials.

What it means

During Avro message parsing, SchemaRegistryBasedAvroBytesDecoder looks up the schema id embedded in the message via registry.getSchemaById(id). The RestClientException catch branch converts an authentication failure (HTTP 401/403 against the schema registry) into a ParseException, meaning the configured credentials (username/password or auth scheme) are missing or invalid, so the schema — and thus the record — cannot be decoded.

Source

Thrown at extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/SchemaRegistryBasedAvroBytesDecoder.java:154

    Schema schema;

    try {
      ParsedSchema parsedSchema = registry.getSchemaById(id);
      schema = parsedSchema instanceof AvroSchema ? ((AvroSchema) parsedSchema).rawSchema() : null;
    }
    catch (IOException ex1) {
      throw new ParseException(
          null,
          ex1,
          "Failed to fetch Avro schema id[%s] from registry. Check if the schema exists in the registry. Otherwise it"
          + " could mean that there is malformed data in the stream or data that doesn't conform to the schema"
          + " specified.",
          id
      );
    }
    catch (RestClientException ex2) {
      if (ex2.getErrorCode() == 401) {
        throw new ParseException(
            null,
            ex2,
            "Failed to authenticate to schema registry for Avro schema id[%s]. Please check your credentials.",
            id
        );
      }
      // For all other errors, just include the code and message received from the library.
      throw new ParseException(
          null,
          ex2,
          "Failed to fetch Avro schema id[%s] from registry. Error code[%s] and message[%s].",
          id,
          ex2.getErrorCode(),
          ex2.getMessage()
      );
    }
    if (schema == null) {
      throw new ParseException(null, "No Avro schema id[%s] in registry", id);

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Check the schema registry username/password (or auth config) in the ingestion spec / schemaRegistryConfig
2. Verify the credentials against the registry directly (e.g. curl with the same auth) to confirm they work
3. If the registry recently rotated credentials, update the spec and restart/re-submit the supervisor

Example fix

// before
"schemaRegistryUrls": ["https://psrc-x.confluent.cloud"], "schemaRegistryAuth": {"username": "oldkey", "password": "oldsecret"}
// after
"schemaRegistryUrls": ["https://psrc-x.confluent.cloud"], "schemaRegistryAuth": {"username": "NEWKEY", "password": "NEWSECRET"}

// verify credentials before deployment
curl -f -u "$SR_USER:$SR_PASS" https://registry.example/schemas/ids/1 > /dev/null && echo OK || echo BAD_CREDENTIALS

try {
  GenericRecord record = decoder.parse(bytes);
} catch (ParseException e) {
  if (e.getMessage().contains("Failed to authenticate")) {
    LOG.error("Schema registry credentials invalid; fail fast, do not retry");
    throw new IllegalStateException("Fix schema registry auth config", e);
  }
}

When it happens

Trigger: parse(ByteBuffer bytes) calls registry.getSchemaById(id); the registry responds 401 because the configured basic-auth username/password are wrong, missing, or expired (e.g., stale API key after credential rotation).

Common situations: Confluent Cloud schema registry requiring API key/secret but no credentials configured; credentials rotated and Druid config not updated; wrong auth type (token vs basic) for the registry.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to find schema for id[%s]
• Failed to decode avro message, not enough bytes to decode (%
• Failed to fetch Avro schema id[%s] from registry. Check if t
• Failed to fetch Avro schema id[%s] from registry. Error code
• No Avro schema id[%s] in registry

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/eded14eb008ecdb9. Report an issue: GitHub.