{"record":{"id":"4f5dd6d675819a7e","repo":"quarkusio/quarkus","slug":"could-not-retrieve-missingkeys-from-credentials","errorCode":null,"errorMessage":"Could not retrieve ${missingKeys} from credentials provider ${providerName}","messagePattern":"Could not retrieve (.+?) from credentials provider (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/proxy-registry/runtime/src/main/java/io/quarkus/proxy/runtime/ProxyConfigurationRecorder.java","lineNumber":113,"sourceCode":"            username = config.username();\n            password = config.password();\n        } else {\n            ProxyConfig.ProxyCredentialProviderConfig providerConfig = config.credentialsProvider();\n            if (providerConfig.name().isPresent()) {\n                CredentialsProvider provider = CredentialsProviderFinder.find(providerConfig.beanName().orElse(null));\n                Map<String, String> credentials = provider.getCredentialsAsync(providerConfig.name().get())\n                        .await().indefinitely();\n                username = Optional.ofNullable(credentials.get(providerConfig.usernameKey()));\n                password = Optional.ofNullable(credentials.get(providerConfig.passwordKey()));\n                if (username.isEmpty() || password.isEmpty()) {\n                    StringJoiner missingKeys = new StringJoiner(\" and \");\n                    if (username.isEmpty()) {\n                        missingKeys.add(providerConfig.usernameKey());\n                    }\n                    if (password.isEmpty()) {\n                        missingKeys.add(providerConfig.passwordKey());\n                    }\n                    throw new IllegalStateException(\"Could not retrieve \" + missingKeys + \" from credentials provider \"\n                            + providerConfig.name().get());\n                }\n            } else {\n                username = Optional.empty();\n                password = Optional.empty();\n            }\n        }\n\n        return Optional.of(new ProxyConfigurationImpl(\n                config.host().get(),\n                config.port().getAsInt(),\n                username,\n                password,\n                config.nonProxyHosts(),\n                config.proxyConnectTimeout(),\n                config.type()));\n    }\n}","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/proxy-registry/runtime/src/main/java/io/quarkus/proxy/runtime/ProxyConfigurationRecorder.java#L95-L131","documentation":"Thrown at build time by ProxyConfigurationRecorder when a proxy configuration references a credentials provider but the provider could not return the requested username and/or password keys. Quarkus collects whichever keys were missing and fails the build with the list so the misconfigured credential lookup is obvious.","triggerScenarios":"quarkus.proxy.\"<name>\".credentials-provider is set (and username/password are not directly set), the named io.quarkus.credentials.CredentialsProvider exists, but credentialsProvider.credentials(name, key) returned empty for the usernameKey and/or passwordKey configured via quarkus.proxy.\"<name>\".credentials-provider.username-key / .password-key.","commonSituations":"The vault/secrets backend (e.g. filesystem, Kubernetes secret mounted later, consul) has no entry for the key at build time; a custom CredentialsProvider returns an empty map; custom username-key/password-key names do not match what the provider stores; the credentials provider is only available at runtime while proxy config is resolved during static init.","solutions":["Ensure the credentials provider actually contains entries for the configured username-key and password-key at build time (check the backing store: file, vault, Kubernetes secret, etc.).","Verify quarkus.proxy.\"<name>\".credentials-provider.name matches a registered CredentialsProvider bean and its name() value.","Check the username-key/password-key values for typos or wrong case.","If credentials are only available at runtime, provide quarkus.proxy.\"<name>\".username and .password directly via runtime config instead of a build-time credentials provider.","Add logging/debug output in your custom CredentialsProvider to see which keys are being requested."],"exampleFix":"// before (application.properties)\nquarkus.proxy.\"corp\".host=proxy.corp.example\nquarkus.proxy.\"corp\".port=8080\nquarkus.proxy.\"corp\".credentials-provider=vault-cred\nquarkus.proxy.\"corp\".credentials-provider.username-key=proxy-user-key\n\n// after (keys match what the provider stores)\nquarkus.proxy.\"corp\".credentials-provider.username-key=corp-proxy/user\nquarkus.proxy.\"corp\".credentials-provider.password-key=corp-proxy/password","handlingStrategy":"validation","validationCode":"// Verify the provider can serve the keys before relying on them at build time\nCredentialsProvider provider = ...; // your registered provider\nMap<String,String> creds = provider.credentials(\"vault-cred\", \"corp-proxy\");\nif (!creds.containsKey(\"corp-proxy/user\") || !creds.containsKey(\"corp-proxy/password\")) {\n    throw new IllegalStateException(\n        \"Credentials provider vault-cred is missing corp-proxy/user and/or corp-proxy/password\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep username-key/password-key names in sync with what the credentials provider actually stores.","Add a unit test for your custom CredentialsProvider covering the exact keys the proxy config requests.","Ensure the backing secret store is populated in build-time environments (CI), not only at deploy time.","If secrets are runtime-only, switch to direct quarkus.proxy.\"name\".username/.password runtime configuration."],"tags":["quarkus","configuration","build-time","credentials-provider","proxy"],"backgroundTag":"credentials-provider-missing-key","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}