{"record":{"id":"b4d8537b7df07596","repo":"quarkusio/quarkus","slug":"public-key-property-can-only-be-used-with-the-s","errorCode":null,"errorMessage":"'public-key' property can only be used with the 'service' applications","messagePattern":"'public-key' property can only be used with the 'service' applications","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":393,"sourceCode":"            return \"quarkus.oidc.\" + tenantId + \".\" + configSubKey;\n        }\n    }\n\n    private boolean enableUserInfo(OidcTenantConfig oidcConfig) {\n        Optional<Boolean> userInfoRequired = oidcConfig.authentication().userInfoRequired();\n        if (userInfoRequired.isPresent()) {\n            if (!userInfoRequired.get()) {\n                return false;\n            }\n        } else {\n            oidcConfig.authentication.setUserInfoRequired(true);\n        }\n        return true;\n    }\n\n    private Uni<TenantConfigContext> createTenantContextFromPublicKey(OidcTenantConfig oidcConfig) {\n        if (!OidcUtils.isServiceApp(oidcConfig)) {\n            throw new ConfigurationException(\"'public-key' property can only be used with the 'service' applications\");\n        }\n        LOG.debug(\"'public-key' property for the local token verification is set,\"\n                + \" no connection to the OIDC server will be created\");\n\n        return TenantConfigContext.createReady(new OidcProvider(oidcConfig.publicKey().get(), oidcConfig), oidcConfig);\n    }\n\n    private Uni<TenantConfigContext> createTenantContextToVerifyCertChain(OidcTenantConfig oidcConfig) {\n        if (!OidcUtils.isServiceApp(oidcConfig)) {\n            throw new ConfigurationException(\n                    \"Currently only 'service' applications can be used to verify tokens with inlined certificate chains\");\n        }\n\n        return TenantConfigContext.createReady(new OidcProvider(null, oidcConfig), oidcConfig);\n    }\n\n    private OIDCException toOidcException(Throwable cause, String authServerUrl, String tenantId) {\n        final String message = OidcCommonUtils.formatConnectionErrorMessage(authServerUrl);","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L375-L411","documentation":"A local public key (public-key property) enables offline JWT verification, which only applies to service applications validating bearer access tokens. If the tenant is not a service app (e.g. web-app or hybrid), Quarkus throws this ConfigurationException in createTenantContextFromPublicKey because web-app code flows require a full OIDC provider connection.","triggerScenarios":"createTenantContext detects a set publicKey but OidcUtils.isServiceApp(oidcConfig) returns false (applicationType not service, or web-app discovery settings present).","commonSituations":"Setting quarkus.oidc.public-key in an application whose default application-type is web-app; reusing a service tenant config with public key after switching types; hybrid app with public key expectation.","solutions":["Set quarkus.oidc.application-type=service so the public key can be used for local verification","Remove quarkus.oidc.public-key and connect to the OIDC provider (web-app flow)","Use per-tenant config: quarkus.oidc.<tenant>.public-key with quarkus.oidc.<tenant>.application-type=service"],"exampleFix":"// before\nquarkus.oidc.application-type=web-app\nquarkus.oidc.public-key=MIIBIjANBg...\n// after\nquarkus.oidc.application-type=service\nquarkus.oidc.public-key=MIIBIjANBg...","handlingStrategy":"validation","validationCode":"if (config.publicKey().isPresent() && !OidcUtils.isServiceApp(config)) {\n    throw new IllegalArgumentException(\"public-key requires application-type=service\");\n}","typeGuard":"boolean isPublicKeyServiceApp(OidcTenantConfig c) {\n    return c.publicKey().isPresent() && OidcUtils.isServiceApp(c);\n}","tryCatchPattern":null,"preventionTips":["Use public-key only in service (bearer) tenants","Keep a dedicated tenant for local-verification endpoints","Re-check application-type after migrating between browser and API security"],"tags":["quarkus","oidc","configuration","public-key"],"backgroundTag":"oidc-public-key-service-only","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}