{"record":{"id":"b8158a2f53aebcb5","repo":"quarkusio/quarkus","slug":"unable-to-find-the-default-credentials-provider","errorCode":null,"errorMessage":"Unable to find the default credentials provider","messagePattern":"Unable to find the default credentials provider","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/CredentialProviders.java","lineNumber":67,"sourceCode":"            CredentialsProvider provider = lookup(config.beanName().orElse(null));\n            Map<String, String> credentials = provider.getCredentialsAsync(config.name().get()).await().indefinitely();\n            return Optional.ofNullable(credentials.get(config.passwordKey()));\n        }\n        return Optional.empty();\n    }\n\n    static CredentialsProvider lookup(String name) {\n        ArcContainer container = Arc.container();\n        InstanceHandle<CredentialsProvider> instance;\n        if (name == null) {\n            instance = container.instance(CredentialsProvider.class);\n        } else {\n            instance = container.instance(CredentialsProvider.class, NamedLiteral.of(name));\n        }\n\n        if (!instance.isAvailable()) {\n            if (name == null) {\n                throw new RuntimeException(\"Unable to find the default credentials provider\");\n            } else {\n                throw new RuntimeException(\"Unable to find the credentials provider named '\" + name + \"'\");\n            }\n        }\n\n        return instance.get();\n    }\n}\n","sourceCodeStart":49,"sourceCodeEnd":76,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/CredentialProviders.java#L49-L76","documentation":"CredentialProviders.lookup resolves a CDI CredentialsProvider bean by name (or the default when name is null) from the ArC container. When no such bean is registered, it throws this RuntimeException, meaning a keystore/truststore password was configured to come from a credentials provider that does not exist.","triggerScenarios":"Config referencing the default credentials provider (no name given) while no CredentialsProvider bean is deployed in the application.","commonSituations":"Enabling credential-provider-based passwords without adding the quarkus-credentials extension or a custom CredentialsProvider bean; bean not annotated/discovered (missing @Singleton, wrong package); provider removed in a refactor.","solutions":["Add the quarkus-credentials extension (or a custom class implementing io.quarkus.credentials.CredentialsProvider marked as @ApplicationScoped/@Singleton)","If a named provider was intended, set the provider name explicitly in config","Verify the provider bean is in a package scanned by Quarkus","Check that the dependency containing the provider is on the runtime classpath"],"exampleFix":"// before: no provider registered, config uses default\n// after\n@ApplicationScoped\npublic class MyCredentialsProvider implements CredentialsProvider {\n    @Override\n    public Map<String, String> getCredentials(String credentialsProviderName) {\n        return Map.of(CredentialsProvider.PASSWORD_PROPERTY_NAME, \"secret\");\n    }\n}","handlingStrategy":"validation","validationCode":"// Verify a CredentialsProvider bean is discoverable before startup relies on it\nOptional<CredentialsProvider> p = Arc.container()\n    .instance(CredentialsProvider.class).handle();\nif (p.isEmpty()) {\n    throw new IllegalStateException(\"Add quarkus-credentials or register a CredentialsProvider bean\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Quarkus.run(args);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"default credentials provider\")) {\n        log.error(\"No CredentialsProvider bean registered; add quarkus-credentials extension\");\n    }\n    throw e;\n}","preventionTips":["Add io.quarkus:quarkus-credentials when referencing credential providers","Annotate custom providers with @ApplicationScoped","Smoke-test provider resolution in a startup health check"],"tags":["tls","credentials-provider","cdi","config"],"backgroundTag":"missing-credentials-provider","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}