{"record":{"id":"24dbad6843d2a085","repo":"pulumi/pulumi","slug":"cannot-call-requireoutputvalue-if-the-referenced","errorCode":null,"errorMessage":"Cannot call 'requireOutputValue' if the referenced stack output is a secret. Use 'requireOutput' instead.","messagePattern":"Cannot call 'requireOutputValue' if the referenced stack output is a secret\\. Use 'requireOutput' instead\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/nodejs/stackReference.ts","lineNumber":170,"sourceCode":"            );\n        }\n        return out;\n    }\n\n    /**\n     * Fetches the value promptly of the named stack output. Throws an error if\n     * the stack output is not found.\n     *\n     * This operation is not supported (and will throw) if the named stack\n     * output is a secret.\n     *\n     * @param name\n     *  The name of the stack output to fetch.\n     */\n    public async requireOutputValue(name: string): Promise<any> {\n        const [out, isSecret] = await this.readOutputValue(\"requireOutputSync\", name, true /*required*/);\n        if (isSecret) {\n            throw new Error(\n                \"Cannot call 'requireOutputValue' if the referenced stack output is a secret. Use 'requireOutput' instead.\",\n            );\n        }\n        return out;\n    }\n\n    private async readOutputValue(callerName: string, outputName: string, required: boolean): Promise<[any, boolean]> {\n        const out = required ? this.requireOutput(outputName) : this.getOutput(outputName);\n        return Promise.all([out.promise(), out.isSecret]);\n    }\n}\n\n/**\n * The set of arguments for constructing a {@link StackReference} resource.\n */\nexport interface StackReferenceArgs {\n    /**\n     * The name of the stack to reference.","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/nodejs/stackReference.ts#L152-L188","documentation":"requireOutputValue requires that the named output exists AND is not secret, returning its raw value. Secrets cannot be returned as plain values, so when the referenced output is secret the SDK throws and points to requireOutput, which returns a secret-aware Output instead.","triggerScenarios":"Calling stackRef.requireOutputValue(name) where the output exists in the referenced stack but was exported via pulumi.secret(...) or otherwise marked secret.","commonSituations":"Downstream code written before upstream hardened the output as a secret; cross-stack DB credentials/API keys; automation expecting plaintext stack outputs from the engine.","solutions":["Replace requireOutputValue with requireOutput(name), keeping the secret wrapped in an Output.","Pass the resulting secret Output directly to resource properties instead of unwrapping it.","If the value must not be secret, change the upstream export and redeploy that stack."],"exampleFix":"// before\nconst key = await stackRef.requireOutputValue(\"apiKey\");\n// after\nconst key = stackRef.requireOutput(\"apiKey\"); // secret Output, pass to resources","handlingStrategy":"fallback","validationCode":"// Use the secret-aware API unconditionally:\nconst key = stackRef.requireOutput(\"apiKey\"); // throws only if missing, keeps secret wrapping","typeGuard":null,"tryCatchPattern":"try {\n  const raw = await stackRef.requireOutputValue(\"apiKey\");\n} catch (err) {\n  if ((err as Error).message.includes(\"is a secret\")) {\n    const key = stackRef.requireOutput(\"apiKey\");\n  } else {\n    throw err;\n  }\n}","preventionTips":["Use requireOutput/getOutput unless you are certain the output is plaintext.","Assume credential-like outputs are secret and pass them as secret Outputs.","When upstream marks an output secret, update all downstream consumers at once."],"tags":["stack-reference","secret","outputs","cross-stack"],"backgroundTag":"secret-output-misuse","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}