{"record":{"id":"bc43808d228a26ab","repo":"alibaba/nacos","slug":"400-bc4380","errorCode":"400","errorMessage":"Please config `nacos.plugin.auth.nacos.token.secret.key`, detail see https://nacos.io/docs/latest/manual/admin/auth/","messagePattern":"Please config `nacos\\.plugin\\.auth\\.nacos\\.token\\.secret\\.key`, detail see https://nacos\\.io/docs/latest/manual/admin/auth/","errorType":"exception","errorClass":"NacosRuntimeException","httpStatus":null,"severity":"critical","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/token/impl/JwtTokenManager.java","lineNumber":141,"sourceCode":"        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {\n            return getTokenValidityInSeconds();\n        }\n        checkJwtParser();\n        return jwtParser.getExpireTimeInSeconds(token)\n            - TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis());\n    }\n    \n    public long getExpiredTimeInSeconds(String token) throws AccessException {\n        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {\n            return getTokenValidityInSeconds();\n        }\n        checkJwtParser();\n        return jwtParser.getExpireTimeInSeconds(token);\n    }\n    \n    private void checkJwtParser() {\n        if (jwtParser == null) {\n            throw new NacosRuntimeException(NacosException.INVALID_PARAM,\n                \"Please config `nacos.plugin.auth.nacos.token.secret.key`, detail see \"\n                    + \"https://nacos.io/docs/latest/manual/admin/auth/\");\n        }\n    }\n}\n","sourceCodeStart":123,"sourceCodeEnd":147,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/token/impl/JwtTokenManager.java#L123-L147","documentation":"JwtTokenManager builds its parser only if a secret key was supplied at construction; with a blank key jwtParser stays null and checkJwtParser() throws NacosRuntimeException(INVALID_PARAM=400). Auth is enabled (the code path that calls checkJwtParser only runs when auth is on) but the operator never set nacos.plugin.auth.nacos.token.secret.key, so the server cannot sign or verify any JWT. This is a fatal misconfiguration surfaced to the caller as a 400.","triggerScenarios":"Enabling nacos.core.auth.enabled=true (or setting system type) without configuring nacos.plugin.auth.nacos.token.secret.key, then performing any login, token validation, or authed config/naming request. Also createToken() when authEnabled but jwtParser is null.","commonSituations":"First-time auth enablement where the secret-key step was skipped; key left blank because it is optional while auth is off, then auth turned on; secret key copied from a template without being set.","solutions":["Set nacos.plugin.auth.nacos.token.secret.key to a Base64 string of at least 32 bytes in application.properties of every node.","Restart the node after setting the key so JwtTokenManager reconstructs the parser.","Ensure all cluster members share the same secret key.","Re-disable auth (nacos.core.auth.enabled=false) only if you intend to run without auth."],"exampleFix":"# before (auth on, no key)\n# application.properties\nnacos.core.auth.enabled=true\n# nacos.plugin.auth.nacos.token.secret.key is unset -> 400\n\n# after\nnacos.core.auth.enabled=true\nnacos.plugin.auth.nacos.token.secret.key=VGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg5\n# then restart all nodes","handlingStrategy":"validation","validationCode":"// At startup, refuse to enable auth unless a secret key is configured.\nimport com.alibaba.nacos.common.utils.StringUtils;\nimport org.springframework.core.env.Environment;\n\nString key = env.getProperty(\"nacos.plugin.auth.nacos.token.secret.key\", \"\");\nboolean authEnabled = Boolean.parseBoolean(env.getProperty(\"nacos.core.auth.enabled\", \"false\"));\nif (authEnabled && StringUtils.isBlank(key)) {\n    throw new IllegalStateException(\n        \"nacos.core.auth.enabled=true but nacos.plugin.auth.nacos.token.secret.key is blank\");\n}\nbyte[] decoded = java.util.Base64.getDecoder().decode(key);\nif (decoded.length < 32) {\n    throw new IllegalStateException(\"token secret key must decode to >= 32 bytes\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    tokenManager.parseToken(token);\n} catch (NacosRuntimeException e) {\n    if (e.getErrCode() == NacosException.INVALID_PARAM\n            && e.getMessage().contains(\"token.secret.key\")) {\n        // fatal misconfiguration -> fail startup, do not serve requests\n        throw new IllegalStateException(\"auth enabled without a token secret key\", e);\n    }\n    throw e;\n}","preventionTips":["Always set nacos.plugin.auth.nacos.token.secret.key when enabling auth.","Validate the key is a Base64 string decoding to >= 32 bytes.","Use the same key on every cluster member.","Add a startup guard so the server fails fast rather than at first request."],"tags":["auth","token","jwt","configuration","secret-key","misconfiguration"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}