{"record":{"id":"d263ec4b7b94d1ad","repo":"pathwaycom/pathway","slug":"schemaregistrysettings-token-authorization-is-m","errorCode":null,"errorMessage":"SchemaRegistrySettings: 'token_authorization' is mutually exclusive with 'username'/'password'. Pick one authentication method.","messagePattern":"SchemaRegistrySettings: 'token_authorization' is mutually exclusive with 'username'/'password'\\. Pick one authentication method\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/pathway/internals/_io_helpers.py","lineNumber":306,"sourceCode":"                    f\"string; got {url!r}.\"\n                )\n        for field_name in (\"token_authorization\", \"username\", \"password\", \"proxy\"):\n            value = getattr(self, field_name)\n            if value is not None and not isinstance(value, str):\n                raise TypeError(\n                    f\"SchemaRegistrySettings.{field_name} must be a str, \"\n                    f\"got {type(value).__name__}.\"\n                )\n        if self.password is not None and self.username is None:\n            raise ValueError(\n                \"SchemaRegistrySettings: 'password' was provided without \"\n                \"'username'. Both are needed for username/password \"\n                \"authentication.\"\n            )\n        if self.token_authorization is not None and (\n            self.username is not None or self.password is not None\n        ):\n            raise ValueError(\n                \"SchemaRegistrySettings: 'token_authorization' is mutually \"\n                \"exclusive with 'username'/'password'. Pick one \"\n                \"authentication method.\"\n            )\n        if self.headers is not None:\n            for i, header in enumerate(self.headers):\n                if not isinstance(header, SchemaRegistryHeader):\n                    raise TypeError(\n                        f\"SchemaRegistrySettings.headers[{i}] must be a \"\n                        f\"SchemaRegistryHeader instance, got \"\n                        f\"{type(header).__name__}. Use \"\n                        f\"pw.io.kafka.SchemaRegistryHeader(key=..., value=...).\"\n                    )\n        if self.timeout is not None:\n            if not isinstance(self.timeout, datetime.timedelta):\n                raise TypeError(\n                    f\"SchemaRegistrySettings.timeout must be a \"\n                    f\"datetime.timedelta, got {type(self.timeout).__name__}.\"","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/pathwaycom/pathway/blob/fa2f74a4649b7c5908690cf60137263d8d80de5f/python/pathway/internals/_io_helpers.py#L288-L324","documentation":"SchemaRegistrySettings rejects configurations that specify both token-based auth ('token_authorization') and username/password basic auth at the same time. Only one authentication method may be active, because the underlying HTTP client would have to pick one Authorization header and the user's intent would be ambiguous. The check runs in __post_init__ as soon as any of the three fields overlap.","triggerScenarios":"SchemaRegistrySettings(urls=[...], token_authorization='tkn', username='user', password='pass'); building settings from a dict that merges defaults from two environments (one token-based, one basic-auth); copy-pasting an example and adding a token on top of existing credentials.","commonSituations":"Migrating a pipeline from basic auth to token auth while old credential variables remain set; layered configuration (base config sets username/password, an overlay adds token_authorization); CI environments leaking both sets of credentials into env vars.","solutions":["Keep only one auth method: either token_authorization or username+password.","Audit config merging (base + overlay dicts, .env files) so credentials from the old method are unset.","Branch explicitly on which credential is available in the environment."],"exampleFix":"# before\nsettings = pw.io.kafka.SchemaRegistrySettings(\n    urls=[\"http://registry:8081\"],\n    token_authorization=os.environ[\"TOKEN\"],\n    username=os.environ.get(\"REGISTRY_USER\"),   # leftover from old setup\n    password=os.environ.get(\"REGISTRY_PASS\"),\n)\n\n# after\nif os.environ.get(\"TOKEN\"):\n    auth = {\"token_authorization\": os.environ[\"TOKEN\"]}\nelse:\n    auth = {\n        \"username\": os.environ[\"REGISTRY_USER\"],\n        \"password\": os.environ[\"REGISTRY_PASS\"],\n    }\nsettings = pw.io.kafka.SchemaRegistrySettings(\n    urls=[\"http://registry:8081\"], **auth\n)","handlingStrategy":"validation","validationCode":"token = os.environ.get(\"REGISTRY_TOKEN\")\nuser = os.environ.get(\"REGISTRY_USERNAME\")\npwd = os.environ.get(\"REGISTRY_PASSWORD\")\nif token and (user or pwd):\n    raise ValueError(\"choose one auth method: token OR username/password\")\nauth = {\"token_authorization\": token} if token else {\"username\": user, \"password\": pwd}\nsettings = pw.io.kafka.SchemaRegistrySettings(urls=urls, **{k: v for k, v in auth.items() if v is not None})","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Branch explicitly on which credential is present instead of merging config layers blindly.","When migrating auth methods, remove the old credentials from env/CI secrets in the same change.","Add a startup check that at most one auth method is configured."],"tags":["kafka","schema-registry","authentication","configuration"],"backgroundTag":null,"analyzedSha":"fa2f74a4649b7c5908690cf60137263d8d80de5f","analyzedAt":"2026-08-15T01:48:17.006Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}