{"record":{"id":"2c315cf952a0d6f3","repo":"quarkusio/quarkus","slug":"scredentials-jwt-token-path-can-only-be-set-whe","errorCode":null,"errorMessage":"'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'","messagePattern":"'(.+?)credentials\\.jwt\\.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":261,"sourceCode":"\n        Credentials.Jwt jwt = creds.jwt();\n        if (jwt.source() == Source.BEARER) {\n            if (isServerConfig && jwt.tokenPath().isEmpty()) {\n                throw new ConfigurationException(\n                        String.format(\"'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'\",\n                                configPrefix));\n            }\n        } else if (jwt.source() == Source.SPIFFE_JWT) {\n            if (jwt.tokenPath().isEmpty() && Arc.container().select(SpiffeClient.class).isUnsatisfied()) {\n                throw new ConfigurationException(String.format(\n                        \"'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available.\"\n                                + \" Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID,\"\n                                + \" or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs\"\n                                + \" from the SPIFFE Workload API\",\n                        configPrefix));\n            }\n        } else if (jwt.source() == Source.CLIENT && jwt.tokenPath().isPresent()) {\n            throw new ConfigurationException(String.format(\n                    \"'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'\",\n                    configPrefix));\n        }\n    }\n\n    public static String prependSlash(String path) {\n        return !path.startsWith(\"/\") ? \"/\" + path : path;\n    }\n\n    public static Buffer encodeForm(MultiMap form) {\n        return encodeForm(form, Buffer.buffer());\n    }\n\n    public static Buffer encodeForm(MultiMap form, Buffer buffer) {\n        for (Map.Entry<String, String> entry : form) {\n            if (buffer.length() != 0) {\n                buffer.appendByte(AMP);\n            }","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L243-L279","documentation":"credentials.jwt.token-path is only meaningful when the JWT comes from an external source ('bearer' or 'spiffe-jwt'). If source is 'client' (the default, meaning Quarkus signs the JWT itself) and a token-path is still set, verifyCommonConfiguration throws at startup to flag the dangling, ignored property.","triggerScenarios":"credentials.jwt.token-path is set while credentials.jwt.source is unset or set to 'client' under the same config prefix.","commonSituations":"Copying a bearer-source config and removing the source line but keeping token-path; leftover token-path after switching from SPIFFE to signed client assertions; typo like source=client explicit with token-path.","solutions":["Remove the credentials.jwt.token-path property if the client signs its own JWT","Or set credentials.jwt.source=bearer (or spiffe-jwt) if the token really comes from a file","Review the credentials.jwt block and keep only properties consistent with the chosen source"],"exampleFix":"# before\nquarkus.oidc-client.credentials.jwt.source=client\nquarkus.oidc-client.credentials.jwt.token-path=/var/run/token\n\n# after\nquarkus.oidc-client.credentials.jwt.source=client","handlingStrategy":"validation","validationCode":"String source = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.source\", String.class).orElse(\"client\");\nboolean tokenPath = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.token-path\", String.class).isPresent();\nif (\"client\".equals(source) && tokenPath)\n    throw new IllegalStateException(\"token-path is only valid for source=bearer or spiffe-jwt\");","typeGuard":null,"tryCatchPattern":"try {\n    start();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"can only be set when the JWT source\")) log.error(\"Remove token-path or set jwt.source=bearer/spiffe-jwt\");\n    throw e;\n}","preventionTips":["Remove token-path when reverting from bearer/spiffe to signed client JWT","Keep jwt.source and token-path edits in the same commit so they stay consistent","Review credentials blocks after copying config between services"],"tags":["quarkus","oidc","configuration"],"backgroundTag":"conflicting-configuration-properties","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}