{"record":{"id":"07d88558f46fc6ac","repo":"quarkusio/quarkus","slug":"1-scredentials-secret-and-1-scredentials-clie","errorCode":null,"errorMessage":"'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive","messagePattern":"'%1\\$scredentials\\.secret' and '%1\\$scredentials\\.client-secret' properties are mutually exclusive","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":176,"sourceCode":"            // Verify that endpoint url is a valid URL\n            URI.create(endpointUrl).toURL();\n        } catch (Throwable ex) {\n            throw new ConfigurationException(\n                    String.format(\"'%s' is invalid\", endpointUrl), ex);\n        }\n    }\n\n    public static void verifyCommonConfiguration(OidcClientCommonConfig oidcConfig, boolean clientIdOptional,\n            boolean isServerConfig) {\n        final String configPrefix = isServerConfig ? \"quarkus.oidc.\" : \"quarkus.oidc-client.\";\n        if (!clientIdOptional && !oidcConfig.clientId().isPresent()) {\n            throw new ConfigurationException(\n                    String.format(\"'%sclient-id' property must be configured\", configPrefix));\n        }\n\n        Credentials creds = oidcConfig.credentials();\n        if (creds.secret().isPresent() && creds.clientSecret().value().isPresent()) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive\",\n                            configPrefix));\n        }\n        boolean clientSecretConfigured = creds.secret().isPresent()\n                || creds.clientSecret().value().isPresent()\n                || creds.clientSecret().provider().key().isPresent();\n        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()\n                || creds.jwt().secretProvider().key().isPresent();\n\n        if (clientSecretConfigured && jwtSecretConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of client secret or JWT secret authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a client secret and a JWT secret property set\",\n                            configPrefix));\n        }\n        int jwtKeyPropsCount = (creds.jwt().key().isPresent() ? 1 : 0)","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L158-L194","documentation":"verifyCommonConfiguration rejects configurations that set both the legacy credentials.secret and the credentials.client-secret properties, since they are two mutually exclusive ways of specifying the same client secret. When both are present, a ConfigurationException names both properties and the config prefix (quarkus.oidc. or quarkus.oidc-client.).","triggerScenarios":"Startup with both quarkus.oidc.credentials.secret and quarkus.oidc.credentials.client-secret (or the quarkus.oidc-client. equivalents) set simultaneously.","commonSituations":"Migration from old config naming to the newer client-secret block where the old property was not removed; merged config files from different sources (env var + properties file) each supplying one variant.","solutions":["Remove credentials.secret and keep credentials.client-secret (recommended, supports secrets provider)","Or remove credentials.client-secret and keep only credentials.secret","Audit environment variables and profile-specific files so only one variant is defined"],"exampleFix":"// before\nquarkus.oidc.credentials.secret=topsecret\nquarkus.oidc.credentials.client-secret.value=topsecret\n// after\nquarkus.oidc.credentials.client-secret.value=topsecret","handlingStrategy":"validation","validationCode":"// pass only one of the two\nif (cfg.optional(\"quarkus.oidc.credentials.secret\").isPresent()\n        && cfg.optional(\"quarkus.oidc.credentials.client-secret.value\").isPresent()) {\n    throw new IllegalArgumentException(\"credentials.secret and credentials.client-secret are mutually exclusive\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    startApplication();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"mutually exclusive\")) {\n        LOG.error(\"Keep only credentials.secret OR credentials.client-secret\");\n    }\n}","preventionTips":["Migrate fully to credentials.client-secret and delete legacy credentials.secret","Grep env vars and profile files for duplicate secret properties","Centralize OIDC credentials in one config source"],"tags":["configuration","oidc","mutually-exclusive"],"backgroundTag":"mutually-exclusive-config-properties","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}