{"record":{"id":"e7bba8bbbca92a5f","repo":"juspay/hyperswitch","slug":"failed-to-decrypt-google-pay-decrypt-configs","errorCode":null,"errorMessage":"Failed to decrypt google pay decrypt configs","messagePattern":"Failed to decrypt google pay decrypt configs","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/router/src/configs/secrets_transformers.rs","lineNumber":582,"sourceCode":"    let paze_decrypt_keys = if let Some(paze_keys) = conf.paze_decrypt_keys {\n        Some(\n            settings::PazeDecryptConfig::convert_to_raw_secret(paze_keys, secret_management_client)\n                .await\n                .expect(\"Failed to decrypt paze decrypt configs\"),\n        )\n    } else {\n        None\n    };\n\n    #[allow(clippy::expect_used)]\n    let google_pay_decrypt_keys = if let Some(google_pay_keys) = conf.google_pay_decrypt_keys {\n        Some(\n            settings::GooglePayDecryptConfig::convert_to_raw_secret(\n                google_pay_keys,\n                secret_management_client,\n            )\n            .await\n            .expect(\"Failed to decrypt google pay decrypt configs\"),\n        )\n    } else {\n        None\n    };\n\n    #[allow(clippy::expect_used)]\n    let applepay_merchant_configs = settings::ApplepayMerchantConfigs::convert_to_raw_secret(\n        conf.applepay_merchant_configs,\n        secret_management_client,\n    )\n    .await\n    .expect(\"Failed to decrypt applepay merchant configs\");\n\n    #[allow(clippy::expect_used)]\n    let payment_method_auth = settings::PaymentMethodAuth::convert_to_raw_secret(\n        conf.payment_method_auth,\n        secret_management_client,\n    )","sourceCodeStart":564,"sourceCodeEnd":600,"githubUrl":"https://github.com/juspay/hyperswitch/blob/afd92843521ced2c6856b98ae4ea332e75102d88/crates/router/src/configs/secrets_transformers.rs#L564-L600","documentation":"Panic in fetch_raw_secrets (crates/router/src/configs/secrets_transformers.rs:582): GooglePayDecryptConfig::convert_to_raw_secret() failed to decrypt the Google Pay decrypt keys via the secret management client, and the expect('Failed to decrypt google pay decrypt configs') turns that Err into a panic during application startup/secret fetching. This is a fatal bootstrap failure — the router cannot load its Google Pay payment-method configuration.","triggerScenarios":"Calling convert_to_raw_secret(google_pay_keys, secret_management_client) when: the encrypted GooglePay keys in the secrets store can't be decrypted (wrong KMS key, corrupted ciphertext, missing key in store), the secret_management_client has bad credentials/region, or the base64/format of the stored secret doesn't match what the decrypt routine expects.","commonSituations":"Rotating KMS keys without re-encrypting stored secrets; environment mismatch (staging secret read with production credentials); misconfigured secret manager (vault/KMS) env vars; Google Pay config present in file/env config but the corresponding encrypted keys absent in the secrets store.","solutions":["Verify the secret_management_client can decrypt other secrets — fix its credentials, region, and KMS key permissions first.","Re-encrypt and re-upload the Google Pay decrypt keys so the stored ciphertext matches the current KMS key/environment.","Confirm the Google Pay keys entry actually exists in the secrets store for this environment (present-but-stale config triggers this path via the Some branch).","Validate the stored secret's encoding/format against what GooglePayDecryptConfig::convert_to_raw_secret expects (base64, JSON structure).","For faster diagnosis, replace the bare expect with error context including the source error before crashing."],"exampleFix":"// before\n.expect(\"Failed to decrypt google pay decrypt configs\"),\n// after\n.unwrap_or_else(|e| panic!(\n    \"Failed to decrypt google pay decrypt configs: {e:?} \\\n     (check KMS credentials and that google_pay keys are encrypted for this env)\"\n)),","handlingStrategy":"validation","validationCode":"// pre-flight: confirm the secret decrypts before startup relies on it\nlet decrypted = secret_management_client\n    .decrypt(google_pay_keys.clone())\n    .await;\nif decrypted.is_err() {\n    eprintln!(\"google pay keys undecryptable in this env — check KMS creds/key\");\n}","typeGuard":null,"tryCatchPattern":"match GooglePayDecryptConfig::convert_to_raw_secret(google_pay_keys, secret_management_client).await {\n    Ok(raw) => Some(raw),\n    Err(e) => panic!(\"Failed to decrypt google pay decrypt configs: {e:?}\"),\n}","preventionTips":["Rotate KMS keys only together with re-encrypting stored secrets","Keep per-environment secrets stores in sync with per-environment credentials","Pre-flight decrypt checks in deploy/CI before the router boots","Never ship config that references google pay keys absent from the active secrets store"],"tags":["kms","secret-management","google-pay","decryption","startup"],"backgroundTag":"decryption-failed","analyzedSha":"afd92843521ced2c6856b98ae4ea332e75102d88","analyzedAt":"2026-09-18T01:18:02.947Z","contentChangedAt":"2026-09-18T01:18:02.947Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}