{"record":{"id":"814a1663d8dcffd8","repo":"ory/hydra","slug":"global-secret-is-not-configured","errorCode":null,"errorMessage":"global secret is not configured","messagePattern":"global secret is not configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"driver/config/provider_fosite.go","lineNumber":25,"sourceCode":"\t\"context\"\n\t\"strings\"\n\t\"time\"\n\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/ory/hydra/v2/fosite\"\n\t\"github.com/ory/hydra/v2/fosite/token/jwt\"\n\t\"github.com/ory/hydra/v2/x\"\n)\n\nvar _ fosite.GlobalSecretProvider = (*DefaultProvider)(nil)\n\nfunc (p *DefaultProvider) GetGlobalSecret(ctx context.Context) ([]byte, error) {\n\tsecrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)\n\n\tif len(secrets) == 0 {\n\t\tp.l.Error(\"The system secret is not configured. Please provide one in the configuration file or environment variables.\")\n\t\treturn nil, errors.New(\"global secret is not configured\")\n\t}\n\n\tsecret := secrets[0]\n\tif len(secret) < 16 {\n\t\tp.l.Errorf(\"System secret must be undefined or have at least 16 characters but only has %d characters.\", len(secret))\n\t\treturn nil, errors.New(\"global secret is too short\")\n\t}\n\n\treturn x.HashStringSecret(secret), nil\n}\n\nvar _ fosite.RotatedGlobalSecretsProvider = (*DefaultProvider)(nil)\n\nfunc (p *DefaultProvider) GetRotatedGlobalSecrets(ctx context.Context) ([][]byte, error) {\n\tsecrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)\n\n\tif len(secrets) < 2 {\n\t\treturn nil, nil","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/driver/config/provider_fosite.go#L7-L43","documentation":"DefaultProvider.GetGlobalSecret reads the system secret(s) from configuration (KeyGetSystemSecret). If none are configured it returns this error, because Hydra needs a global secret for encrypting/decrypting cookies and database-stored secrets. GetCookieSecrets and validation paths call it during startup.","triggerScenarios":"Calling GetGlobalSecret (directly or via GetCookieSecrets / startup validation) when the `secrets.system` config array is empty — no secret in the config file and none in the ORY_HYDRA_SECRETS_SYSTEM environment variable.","commonSituations":"New Hydra install without secrets.system set; Docker deployment missing the ORY_HYDRA_SECRETS_SYSTEM env var; config file that defines only secrets.cookie.","solutions":["Set `secrets.system` in the config to at least one 16+ character secret, ideally generated with `openssl rand -base64 32`","Set the environment variable ORY_HYDRA_SECRETS_SYSTEM with the generated value","Persist the secret (secret manager / encrypted storage) so it stays stable across restarts — changing it invalidates stored encrypted data"],"exampleFix":"// before (hydra.yml)\nsecrets: {}\n// after\nsecrets:\n  system:\n    - \"A-base64-or-random-string-of-at-least-16-chars\"","handlingStrategy":"validation","validationCode":"if len(os.Getenv(\"ORY_HYDRA_SECRETS_SYSTEM\")) == 0 {\n    return errors.New(\"ORY_HYDRA_SECRETS_SYSTEM must be set before starting Hydra\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision secrets.system via a secret manager at deploy time","Generate with `openssl rand -base64 32`","Keep the secret stable across restarts to avoid decrypt failures"],"tags":["config","secrets","hydra","startup"],"backgroundTag":"missing-env-var","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}