apache/seatunnel · error · OptionValidationException

Invalid secret_key: not Base64 encoded

Error message

Invalid secret_key: not Base64 encoded

What it means

The secret_key option must be a Base64-encoded 32-byte AES-256 key. Validation first Base64-decodes the value; if decoding throws IllegalArgumentException, OptionValidationException 'Invalid secret_key: not Base64 encoded' is thrown. This catches keys containing characters outside the Base64 alphabet or invalid padding.

Source

Thrown at seatunnel-connectors-v2/connector-edge-socket/src/main/java/org/apache/seatunnel/connectors/seatunnel/edgesocket/source/EdgeSocketSourceFactory.java:158

        @Override
        public boolean evaluate(ReadonlyConfig config, String secretKey) {
            if (secretKey == null) {
                return true;
            }
            EdgeSocketPacketMode packetMode;
            try {
                packetMode = config.get(EdgeSocketSourceOptions.PACKET_MODE);
            } catch (IllegalArgumentException exception) {
                return true;
            }
            if (packetMode != EdgeSocketPacketMode.PACKET) {
                return true;
            }
            byte[] secretKeyBytes;
            try {
                secretKeyBytes = Base64.getDecoder().decode(secretKey);
            } catch (IllegalArgumentException exception) {
                throw new OptionValidationException("Invalid secret_key: not Base64 encoded");
            }
            if (secretKeyBytes.length != 32) {
                throw new OptionValidationException(
                        "Invalid secret_key: AES-256 requires exactly 32 bytes, "
                                + "but got %d bytes after Base64 decoding",
                        secretKeyBytes.length);
            }
            return true;
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Regenerate the key as 32 random bytes and Base64-encode it, e.g. `openssl rand -base64 32`, and paste exactly that value.
2. If your key is hex, convert to Base64: `echo <hex> | xxd -r -p | base64`.
3. Trim whitespace/quotes and verify padding (value length multiple of 4).
4. Ensure the same encoded key is used on both sender and receiver.

Example fix

// before
secret_key = "0123456789abcdef0123456789abcdef" // hex, not Base64
// after
secret_key = "ASIscmWlnSPjJDvFXT4fzn9WXCFxHqcueqcbfXhz1Ro=" // openssl rand -base64 32

boolean base64Ok;
try { Base64.getDecoder().decode(secretKey); base64Ok = true; }
catch (IllegalArgumentException e) { base64Ok = false; }
if (!base64Ok) throw new IllegalArgumentException("secret_key is not valid Base64");

try {
    factory.apply(config);
} catch (OptionValidationException e) {
    log.error("secret_key not Base64: {}", e.getMessage());
}

When it happens

Trigger: evaluate() is called with a secret_key containing illegal characters (spaces, '!', unicode), wrong padding (missing '=' or stray characters), a raw hex or plaintext key, or an empty-but-present string when a key is required.

Common situations: Generating a key and pasting the hex form instead of Base64; copying the key with surrounding quotes/whitespace; hand-editing the key and breaking padding; using a passphrase string directly as the key.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• transport.aes-secret-key-base64 is required when transport.e
• Unknown encryption: ${value}
• Schema config can not be empty
• Unknown format type:
• Option '${option}' cannot be blank

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/59af364467f510df. Report an issue: GitHub.