{"record":{"id":"94c28f8217181b4c","repo":"quarkusio/quarkus","slug":"client-credentials-cannot-be-sent-to-all-oidc-endp","errorCode":null,"errorMessage":"Client credentials cannot be sent to all OIDC endpoints because only 'client_secret_basic' or JWT bearer ('jwt.source=bearer') authentication methods are supported","messagePattern":"Client credentials cannot be sent to all OIDC endpoints because only 'client_secret_basic' or JWT bearer \\('jwt\\.source=bearer'\\) authentication methods are supported","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":462,"sourceCode":"        return (creds.clientSecret().value().isPresent() || creds.clientSecret().provider().key().isPresent())\n                && clientSecretMethod(creds) == Secret.Method.POST;\n    }\n\n    public static boolean isClientSecretPostJwtAuthRequired(Credentials creds) {\n        return clientSecretMethod(creds) == Secret.Method.POST_JWT;\n    }\n\n    public static void validateCredentialsForAllEndpoints(Credentials creds) {\n        if (!creds.forAllEndpoints()) {\n            return;\n        }\n        if (isClientSecretBasicAuthRequired(creds)) {\n            return;\n        }\n        if (creds.jwt().source() == Source.BEARER && creds.jwt().tokenPath().isPresent()) {\n            return;\n        }\n        throw new ConfigurationException(\n                \"Client credentials cannot be sent to all OIDC endpoints because only \"\n                        + \"'client_secret_basic' or JWT bearer ('jwt.source=bearer') authentication methods are supported\");\n    }\n\n    public static boolean isJwtAssertion(Credentials creds) {\n        return creds.jwt().assertion();\n    }\n\n    public static Uni<String> clientSecret(Credentials creds) {\n        if (creds.secret().isPresent()) {\n            return Uni.createFrom().item(creds.secret().get());\n        }\n        if (creds.clientSecret().value().isPresent()) {\n            return Uni.createFrom().item(creds.clientSecret().value().get());\n        }\n        return fromCredentialsProvider(creds.clientSecret().provider());\n    }\n","sourceCodeStart":444,"sourceCodeEnd":480,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L444-L480","documentation":"When OIDC client credentials must be sent to all OIDC endpoints, only two methods are supported: HTTP Basic with the client secret (client_secret_basic) or a JWT bearer client assertion (jwt.source=bearer). Any other credential arrangement (e.g. client_secret_post, or a non-bearer JWT) is rejected at startup.","triggerScenarios":"Credentials configured so that isClientSecretBasicAuthRequired is false and credentials are not jwt.source=bearer with a tokenPath — e.g. quarkus.oidc.credentials.client-secret.method=post, or a JWT used as a signed (assertion) token while the client still needs credentials on token/revocation/introspection endpoints.","commonSituations":"Configuring client_secret_post because the OIDC provider recommends it for token requests while other endpoints also need credentials; copying a client-assertion config from a provider that only supports bearer JWT for its token endpoint.","solutions":["Switch the client secret method to basic: quarkus.oidc.credentials.client-secret.method=basic (or just supply the secret, which defaults to basic)","Use a JWT bearer assertion: set quarkus.oidc.credentials.jwt.source=bearer and quarkus.oidc.credentials.jwt.token-path","Check whether credentials are actually required for all endpoints; if not, adjust so credentials only apply where supported","Consult provider docs — if only client_secret_post is supported, verify the endpoint subset the method applies to avoids this check"],"exampleFix":"// before\nquarkus.oidc.credentials.client-secret.value=secret\nquarkus.oidc.credentials.client-secret.method=post\n// after\nquarkus.oidc.credentials.client-secret.value=secret\nquarkus.oidc.credentials.client-secret.method=basic","handlingStrategy":"validation","validationCode":"String method = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.client-secret.method\", String.class).orElse(\"basic\");\nString jwtSource = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.jwt.source\", String.class).orElse(\"\");\nboolean ok = \"basic\".equals(method) || \"bearer\".equals(jwtSource);\nif (!ok) throw new IllegalStateException(\"Use client_secret_basic or jwt.source=bearer for all-endpoint credentials\");","typeGuard":null,"tryCatchPattern":"try { startApp(); } catch (ConfigurationException e) { if (e.getMessage().contains(\"client_secret_basic\")) log.error(\"Switch client auth method to basic or jwt.source=bearer\"); throw e; }","preventionTips":["Prefer the default basic method for client secrets","Only use client_secret_post when the token endpoint alone requires it and credentials are scoped accordingly","Review provider docs on which auth methods apply to token/introspection/revocation endpoints"],"tags":["oidc","config","authentication","client-credentials"],"backgroundTag":"unsupported-auth-method","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}