{"record":{"id":"633756fa4129c056","repo":"quarkusio/quarkus","slug":"scredentials-jwt-token-path-must-be-set-when-th","errorCode":null,"errorMessage":"'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'","messagePattern":"'(.+?)credentials\\.jwt\\.token-path' must be set when the JWT source is 'bearer'","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":247,"sourceCode":"        if (jwtKeyConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT private key or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a JWT key property and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));\n        }\n        if (jwtSecretConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT secret or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a JWT secret and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));\n        }\n\n        Credentials.Jwt jwt = creds.jwt();\n        if (jwt.source() == Source.BEARER) {\n            if (isServerConfig && jwt.tokenPath().isEmpty()) {\n                throw new ConfigurationException(\n                        String.format(\"'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'\",\n                                configPrefix));\n            }\n        } else if (jwt.source() == Source.SPIFFE_JWT) {\n            if (jwt.tokenPath().isEmpty() && Arc.container().select(SpiffeClient.class).isUnsatisfied()) {\n                throw new ConfigurationException(String.format(\n                        \"'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available.\"\n                                + \" Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID,\"\n                                + \" or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs\"\n                                + \" from the SPIFFE Workload API\",\n                        configPrefix));\n            }\n        } else if (jwt.source() == Source.CLIENT && jwt.tokenPath().isPresent()) {\n            throw new ConfigurationException(String.format(\n                    \"'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'\",\n                    configPrefix));\n        }\n    }","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L229-L265","documentation":"When credentials.jwt.source=bearer, Quarkus does not generate the client JWT — it reads it from a token file (e.g. a mounted service-account token). If that token-path is not set (and this check applies to server-side OIDC configurations, isServerConfig), startup fails because there is no way to obtain the bearer token.","triggerScenarios":"verifyCommonConfiguration with isServerConfig=true (OIDC server config, e.g. quarkus.oidc.*) and credentials.jwt.source=bearer but credentials.jwt.token-path not set.","commonSituations":"Enabling bearer source on a quarkus.oidc (server) config but forgetting token-path — note the check is skipped for quarkus.oidc-client configs where path may be optional; typos in property name; K8s volume not mounted so property was never added.","solutions":["Set quarkus.oidc.credentials.jwt.token-path to the file containing the bearer token, e.g. /var/run/secrets/kubernetes.io/serviceaccount/token","If you meant a client config, configure it under quarkus.oidc-client.credentials.jwt.token-path where the check does not apply","Or drop jwt.source=bearer if the token is not externally supplied"],"exampleFix":"# before\nquarkus.oidc.credentials.jwt.source=bearer\n\n# after\nquarkus.oidc.credentials.jwt.source=bearer\nquarkus.oidc.credentials.jwt.token-path=/var/run/secrets/kubernetes.io/serviceaccount/token","handlingStrategy":"validation","validationCode":"String source = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.jwt.source\", String.class).orElse(null);\nString tokenPath = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.jwt.token-path\", String.class).orElse(null);\nif (\"bearer\".equals(source) && (tokenPath == null || tokenPath.isBlank()))\n    throw new IllegalStateException(\"jwt.source=bearer requires jwt.token-path\");","typeGuard":null,"tryCatchPattern":"try {\n    start();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"token-path\")) log.error(\"Set jwt.token-path for bearer source\");\n    throw e;\n}","preventionTips":["Always pair jwt.source=bearer with token-path in templates","Mount and reference the token file (e.g. service-account token) explicitly","Add a CI startup test so missing token-path fails before deployment"],"tags":["quarkus","oidc","configuration","jwt"],"backgroundTag":"missing-required-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}