{"record":{"id":"46d4c9d7d6b76853","repo":"risingwavelabs/risingwave","slug":"invalid-credentials-url-scheme-only-file","errorCode":null,"errorMessage":"invalid credentials_url scheme '{}', only file://, s3://, and absolute file paths are supported","messagePattern":"invalid credentials_url scheme '(.+?)', only file://, s3://, and absolute file paths are supported","errorType":"validation","errorClass":"ConnectorError","httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/common.rs","lineNumber":786,"sourceCode":"        &self,\n        url: &Url,\n        aws_auth_props: &AwsAuthProps,\n    ) -> ConnectorResult<(String, Option<NamedTempFile>)> {\n        match url.scheme() {\n            \"s3\" => {\n                let credentials = load_file_descriptor_from_s3(url, aws_auth_props).await?;\n                let temp_file = create_credential_temp_file(&credentials)\n                    .context(\"failed to create temp file for pulsar credentials\")?;\n\n                let temp_path = temp_file\n                    .path()\n                    .to_str()\n                    .context(\"temp file path is not valid UTF-8\")?;\n\n                Ok((format!(\"file://{}\", temp_path), Some(temp_file)))\n            }\n            \"file\" => Ok((url.to_string(), None)),\n            _ => bail!(\n                \"invalid credentials_url scheme '{}', only file://, s3://, and absolute file paths are supported\",\n                url.scheme()\n            ),\n        }\n    }\n}\n\n#[serde_as]\n#[derive(Deserialize, Debug, Clone, WithOptions)]\npub struct KinesisCommon {\n    #[serde(rename = \"stream\", alias = \"kinesis.stream.name\")]\n    pub stream_name: String,\n    #[serde(rename = \"aws.region\", alias = \"kinesis.stream.region\")]\n    pub stream_region: String,\n    #[serde(rename = \"endpoint\", alias = \"kinesis.endpoint\")]\n    pub endpoint: Option<String>,\n    #[serde(\n        rename = \"aws.credentials.access_key_id\",","sourceCodeStart":768,"sourceCodeEnd":804,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/common.rs#L768-L804","documentation":"Raised by `handle_pulsar_credentials_url` when the credentials_url is a valid URL whose scheme is not one of the supported ones (`file`, `s3`; plus the s3 branch handled earlier). Any other scheme — http(s)://, gs://, etc. — is rejected because RisingWave can only fetch Pulsar OAuth credentials from local files or S3.","triggerScenarios":"Setting `oauth.credentials_url` to e.g. `https://example.com/creds.json` or `gs://bucket/creds.json` when building a Pulsar client via `resolve_pulsar_credentials_url`.","commonSituations":"Copying a credentials_url from cloud vendor docs that use http(s), migrating from another streaming platform that supported HTTP URLs, or assuming GCS is supported.","solutions":["Download the credentials file and reference it with `file:///path/to/creds.json` or an absolute path.","Upload the file to S3 and use `s3://bucket/creds.json`.","Do not use http(s):// or other object-store schemes; they are not supported for credentials_url."],"exampleFix":"// before\ncredentials_url = \"https://auth.example.com/creds.json\"\n// after\ncredentials_url = \"s3://my-bucket/pulsar/creds.json\"","handlingStrategy":"validation","validationCode":"function validateCredUrlScheme(v) {\n  if (v.startsWith('/')) return;\n  const scheme = v.split('://')[0];\n  if (!['file', 's3'].includes(scheme)) {\n    throw new Error(`unsupported scheme '${scheme}', use file://, s3://, or an absolute path`);\n  }\n}\nvalidateCredUrlScheme(oauth.credentials_url);","typeGuard":null,"tryCatchPattern":"try { await createPulsarSource(cfg); } catch (e) { if (String(e).includes('invalid credentials_url scheme')) throw new Error('Only file://, s3://, or absolute paths are supported; download the file or upload it to S3 first.'); throw e; }","preventionTips":["Download HTTP-hosted credentials to disk or S3 before configuring RisingWave.","Document supported schemes (file://, s3://) in your platform's config templates.","Lint credentials_url against the allowed scheme list at deploy time."],"tags":["pulsar","oauth","url","unsupported"],"backgroundTag":"invalid-url-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}