{"record":{"id":"0524994e45fb41b1","repo":"quarkusio/quarkus","slug":"only-one-of-client-secret-or-jwt-bearer-spiffe-aut","errorCode":null,"errorMessage":"Only one of client secret or JWT bearer/SPIFFE authentication methods can be configured, but '%1$scredentials' has both a client secret and '%1$scredentials.jwt.source=%2$s' set","messagePattern":"Only one of client secret or JWT bearer/SPIFFE authentication methods can be configured, but '%1\\$scredentials' has both a client secret and '%1\\$scredentials\\.jwt\\.source=%2\\$s' set","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":223,"sourceCode":"        boolean jwtBearerOrSpiffe = creds.jwt().source() == Source.BEARER\n                || creds.jwt().source() == Source.SPIFFE_JWT;\n\n        if (jwtSecretConfigured && jwtKeyConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT secret or JWT private key authentication methods can be configured,\"\n                                    + \" but '%1$scredentials.jwt' has both a JWT secret and a JWT key property set\",\n                            configPrefix));\n        }\n        if (clientSecretConfigured && jwtKeyConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of client secret or JWT private key authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a client secret and a JWT key property set\",\n                            configPrefix));\n        }\n        if (clientSecretConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of client secret or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a client secret and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));\n        }\n        if (jwtKeyConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT private key or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a JWT key property and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));\n        }\n        if (jwtSecretConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT secret or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a JWT secret and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L205-L241","documentation":"credentials.jwt.source=bearer (or spiffe-jwt) means the JWT is fetched from an external source and sent as a bearer token, which is incompatible with configuring a client secret. verifyCommonConfiguration fails startup when both a client secret and a bearer/spiffe JWT source are set, listing the configured source value in the message.","triggerScenarios":"Setting quarkus.oidc[-client].credentials.jwt.source=bearer (or spiffe-jwt) while also configuring credentials.client.secret under the same prefix.","commonSituations":"A default secret config inherited by a client switched to externally-provided bearer tokens; copy-pasting a named-provider block that keeps both properties; platform team injects secrets via env vars while app config enables bearer JWT.","solutions":["Remove credentials.client.secret if the client should use bearer/spiffe JWT tokens","Or remove/rename credentials.jwt.source if the client should authenticate with the secret","Ensure no environment variable or profile supplies the second property"],"exampleFix":"# before\nquarkus.oidc-client.credentials.client-secret.value=secret123\nquarkus.oidc-client.credentials.jwt.source=bearer\n\n# after\nquarkus.oidc-client.credentials.jwt.source=bearer\nquarkus.oidc-client.credentials.jwt.token-path=/var/run/secrets/token","handlingStrategy":"validation","validationCode":"String source = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.source\", String.class).orElse(null);\nboolean clientSecret = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.client-secret.value\", String.class).isPresent();\nif (clientSecret && (\"bearer\".equals(source) || \"spiffe-jwt\".equals(source)))\n    throw new IllegalStateException(\"Client secret cannot be combined with jwt.source=\" + source);","typeGuard":null,"tryCatchPattern":"try {\n    start();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"bearer/SPIFFE\")) log.error(\"Remove client secret or the jwt.source setting\");\n    throw e;\n}","preventionTips":["When enabling bearer/spiffe-jwt source, remove client-secret properties in the same change","Check env-var-injected secrets (e.g. K8s secrets) for conflicts","Keep credentials config blocks minimal and source-specific"],"tags":["quarkus","oidc","configuration","jwt"],"backgroundTag":"conflicting-configuration-properties","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}