{"record":{"id":"434314a7389a98b2","repo":"docker/cli","slug":"invalid-credential-spec-value-must-be-prefixed-wi","errorCode":null,"errorMessage":"invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"","messagePattern":"invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/service/opts.go","lineNumber":402,"sourceCode":"\t\t// Therefore, this isn't the definitive location for the value of\n\t\t// Config that is passed to the API.\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tConfig: val,\n\t\t}\n\t\treturn nil\n\tcase credentialSpecFile:\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tFile: val,\n\t\t}\n\t\treturn nil\n\tcase credentialSpecRegistry:\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tRegistry: val,\n\t\t}\n\t\treturn nil\n\tdefault:\n\t\tc.value = &swarm.CredentialSpec{}\n\t\treturn errors.New(`invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"`)\n\t}\n}\n\nfunc (*credentialSpecOpt) Type() string {\n\treturn \"credential-spec\"\n}\n\nfunc (c *credentialSpecOpt) String() string {\n\treturn c.source\n}\n\nfunc (c *credentialSpecOpt) Value() *swarm.CredentialSpec {\n\treturn c.value\n}\n\nfunc resolveNetworkID(ctx context.Context, apiClient client.NetworkAPIClient, networkIDOrName string) (string, error) {\n\tres, err := apiClient.NetworkInspect(ctx, networkIDOrName, client.NetworkInspectOptions{Scope: \"swarm\"})\n\tif err != nil {","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/service/opts.go#L384-L420","documentation":"The `--credential-spec` flag (Windows-only, for managed service accounts) requires a URL-scheme prefix to identify the credential source. The `credentialSpecOpt.Set` method at opts.go:362-403 parses the scheme via `strings.Cut(value, \"://\")` and accepts `config://`, `file://`, or `registry://`. An empty string is valid (used to clear the spec during updates, line 365-371). Any non-empty value that does not start with one of the three valid schemes hits the `default` case at line 400-402.","triggerScenarios":"Passing `--credential-spec myconfig` (no scheme), `--credential-spec C:\\path\\to\\spec.json` (bare file path without `file://` prefix), or `--credential-spec configs/myconfig` (Docker config name without `config://` prefix).","commonSituations":"A Windows shop migrating from `docker run --credential-spec` confuses the flag value format. The developer passes the config name or file path directly without the required URL scheme prefix.","solutions":["For Docker config-based specs: prefix with `config://`, e.g., `--credential-spec config://myconfig`","For file-based specs: prefix with `file://`, e.g., `--credential-spec file://C:/path/spec.json`","For registry-based specs: prefix with `registry://`, e.g., `--credential-spec registry://fabric/MyServiceAccount`","To clear an existing spec on update: pass `--credential-spec \"\"` (empty string)"],"exampleFix":"# before\ndocker service create --credential-spec myconfig --image myimage web\n# error: invalid credential spec: value must be prefixed with ...\n\n# after (Docker config)\ndocker service create --credential-spec config://myconfig --image myimage web\n\n# after (file path)\ndocker service create --credential-spec file://C:/spec.json --image myimage web","handlingStrategy":"validation","validationCode":"// Validate credential spec before calling Set\nfunc validateCredentialSpec(value string) error {\n    if value == \"\" {\n        return nil // empty is valid (clears spec on update)\n    }\n    scheme, _, ok := strings.Cut(value, \"://\")\n    if !ok {\n        return errors.New(`value must be prefixed with \"config://\", \"file://\", or \"registry://\"`)\n    }\n    switch credentialSpecType(scheme) {\n    case credentialSpecConfig, credentialSpecFile, credentialSpecRegistry:\n        return nil\n    default:\n        return errors.New(`invalid credential spec scheme: ` + scheme)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always prefix credential-spec values with config://, file://, or registry://","Use config:// for Docker config-based specs (the config name is resolved to an ID later)","This flag is Windows-only — verify the target platform before setting it"],"tags":["docker","cli","service","windows","credentials","flag-validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}