apache/pulsar · error · IllegalArgumentException

Secret/Public Key file ${keyConfUrl} doesn't exist

Error message

Secret/Public Key file ${keyConfUrl} doesn't exist

What it means

AuthTokenUtils.readKeyFromUrl could not interpret the key configuration as a file URL, existing file path, or valid base64 — no Secret/Public Key file exists for the given keyConfUrl, so key loading fails.

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/utils/AuthTokenUtils.java:135

            } catch (IOException e) {
                throw e;
            } catch (Exception e) {
                throw new IOException(e);
            }
        } else if (Files.exists(Paths.get(keyConfUrl))) {
            // Assume the key content was passed in a valid file path
            return Files.readAllBytes(Paths.get(keyConfUrl));
        } else if (Base64.isBase64(keyConfUrl.getBytes())) {
            // Assume the key content was passed in base64
            try {
                return Decoders.BASE64.decode(keyConfUrl);
            } catch (DecodingException e) {
                String msg = "Illegal base64 character or Key file " + keyConfUrl + " doesn't exist";
                throw new IOException(msg, e);
            }
        } else {
            String msg = "Secret/Public Key file " + keyConfUrl + " doesn't exist";
            throw new IllegalArgumentException(msg);
        }
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Fix the secret/public key path or supply the key as base64
2. Ensure the key file exists and is readable by the broker

Example fix

# before (broker.conf)
tokenSecretKey=/home/me/keys/secret.key   # file not present on broker
# after
tokenSecretKey=file:///pulsar/secret/secret.key  # mounted + verified
# or inline:
tokenSecretKey=MIIBIjANBgkq...

java.nio.file.Path p = java.nio.file.Path.of(keyPath);
if (!java.nio.file.Files.isRegularFile(p) || !java.nio.file.Files.isReadable(p))
    throw new IllegalStateException("key file missing or unreadable: " + p.toAbsolutePath());

boolean keyFileUsable(String path) { return path != null && java.nio.file.Files.isRegularFile(java.nio.file.Path.of(path)) && java.nio.file.Files.isReadable(java.nio.file.Path.of(path)); }

try { byte[] key = AuthTokenUtils.readKeyFromUrl(url); } catch (IllegalArgumentException e) { log.error("key file/URL not found: {}", e.getMessage()); throw e; }

When it happens

Trigger: Setting tokenSecretKey/tokenPublicKey to a path that doesn't exist on the broker filesystem, a relative path resolved against the wrong working directory, or a typo'd value that fails both the URL/file lookup and the Base64.isBase64 check.

Common situations: Kubernetes/container deployments where the key file was mounted at a different path than configured; using an absolute path from a dev machine on the server; forgetting to mount the secret volume; missing `file://` handling or environment-specific config override.

Related errors

• The ${alg.name()} algorithm does not support Key Pairs.
• certFilePath must not be null
• keyFilePath must not be null
• Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KE
• Invalid broker configuration. Authentication must be enabled

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/fd18ed1cc93900c8. Report an issue: GitHub.