{"record":{"id":"b35c491d3e0f6c56","repo":"quarkusio/quarkus","slug":"only-one-of-1-scredentials-jwt-key-1-screden","errorCode":null,"errorMessage":"Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.key-file' or '%1$scredentials.jwt.key-store-file' can be configured","messagePattern":"Only one of '%1\\$scredentials\\.jwt\\.key', '%1\\$scredentials\\.jwt\\.key-file' or '%1\\$scredentials\\.jwt\\.key-store-file' can be configured","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":198,"sourceCode":"        }\n        boolean clientSecretConfigured = creds.secret().isPresent()\n                || creds.clientSecret().value().isPresent()\n                || creds.clientSecret().provider().key().isPresent();\n        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()\n                || creds.jwt().secretProvider().key().isPresent();\n\n        if (clientSecretConfigured && jwtSecretConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of client secret or JWT secret authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a client secret and a JWT secret property set\",\n                            configPrefix));\n        }\n        int jwtKeyPropsCount = (creds.jwt().key().isPresent() ? 1 : 0)\n                + (creds.jwt().keyFile().isPresent() ? 1 : 0)\n                + (creds.jwt().keyStoreFile().isPresent() ? 1 : 0);\n        if (jwtKeyPropsCount > 1) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.key-file'\"\n                                    + \" or '%1$scredentials.jwt.key-store-file' can be configured\",\n                            configPrefix));\n        }\n        boolean jwtKeyConfigured = jwtKeyPropsCount == 1;\n        boolean jwtBearerOrSpiffe = creds.jwt().source() == Source.BEARER\n                || creds.jwt().source() == Source.SPIFFE_JWT;\n\n        if (jwtSecretConfigured && jwtKeyConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT secret or JWT private key authentication methods can be configured,\"\n                                    + \" but '%1$scredentials.jwt' has both a JWT secret and a JWT key property set\",\n                            configPrefix));\n        }\n        if (clientSecretConfigured && jwtKeyConfigured) {\n            throw new ConfigurationException(","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L180-L216","documentation":"Quarkus OIDC client credentials allow signing a client JWT with either a raw secret, a PEM private key file, or a keystore file — but only one at a time. During startup, verifyCommonConfiguration counts how many of credentials.jwt.key, credentials.jwt.key-file and credentials.jwt.key-store-file are set; if more than one is present, startup aborts with this ConfigurationException so the ambiguity is caught before any token request is made.","triggerScenarios":"Setting two or more of quarkus.oidc-client.credentials.jwt.key, quarkus.oidc-client.credentials.jwt.key-file and quarkus.oidc-client.credentials.jwt.key-store-file (with the config prefix matching the named OIDC provider, e.g. quarkus.oidc.<name>.credentials.jwt.*) in application.properties at startup.","commonSituations":"Left-over key-file property when switching to an inline key; copy-pasting config from two examples; environment-variable override adding a keystore on top of an existing key-file; team migration from PEM to keystore without deleting the old property.","solutions":["Remove the properties you do not want, keeping exactly one of credentials.jwt.key, credentials.jwt.key-file, credentials.jwt.key-store-file","Run ./quarkus dev or mvn quarkus:dev to confirm the app starts and check which effective properties are set (quarkus.config ExpandConfigSource)","If you need multiple deployment variants, use Maven/Quarkus profiles to enable only one property per profile instead of setting all at once"],"exampleFix":"# before\nquarkus.oidc-client.credentials.jwt.key=abc123\nquarkus.oidc-client.credentials.jwt.key-file=/etc/certs/key.pem\n\n# after\nquarkus.oidc-client.credentials.jwt.key-file=/etc/certs/key.pem","handlingStrategy":"validation","validationCode":"long count = Stream.of(\n        ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.key\", String.class),\n        ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.key-file\", String.class),\n        ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.key-store-file\", String.class))\n    .filter(Optional::isPresent).count();\nif (count > 1) throw new IllegalStateException(\"Configure at most one jwt key property\");","typeGuard":null,"tryCatchPattern":"try {\n    runApp();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"jwt.key\")) {\n        log.error(\"Fix OIDC credentials: keep only one of jwt.key/key-file/key-store-file\");\n    }\n    throw e;\n}","preventionTips":["Keep only one jwt key property per config prefix; delete others when changing auth style","Use profiles to vary credentials per environment instead of setting several properties","Grep application.properties for 'credentials.jwt.key' in CI to detect duplicates early"],"tags":["quarkus","oidc","configuration","startup"],"backgroundTag":"conflicting-configuration-properties","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}