{"record":{"id":"fd18ed1cc93900c8","repo":"apache/pulsar","slug":"secret-public-key-file-keyconfurl-doesn-t-exist","errorCode":null,"errorMessage":"Secret/Public Key file ${keyConfUrl} doesn't exist","messagePattern":"Secret/Public Key file (.+?) doesn't exist","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/utils/AuthTokenUtils.java","lineNumber":135,"sourceCode":"            } catch (IOException e) {\n                throw e;\n            } catch (Exception e) {\n                throw new IOException(e);\n            }\n        } else if (Files.exists(Paths.get(keyConfUrl))) {\n            // Assume the key content was passed in a valid file path\n            return Files.readAllBytes(Paths.get(keyConfUrl));\n        } else if (Base64.isBase64(keyConfUrl.getBytes())) {\n            // Assume the key content was passed in base64\n            try {\n                return Decoders.BASE64.decode(keyConfUrl);\n            } catch (DecodingException e) {\n                String msg = \"Illegal base64 character or Key file \" + keyConfUrl + \" doesn't exist\";\n                throw new IOException(msg, e);\n            }\n        } else {\n            String msg = \"Secret/Public Key file \" + keyConfUrl + \" doesn't exist\";\n            throw new IllegalArgumentException(msg);\n        }\n    }\n}\n","sourceCodeStart":117,"sourceCodeEnd":139,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/utils/AuthTokenUtils.java#L117-L139","documentation":"AuthTokenUtils.readKeyFromUrl could not interpret the key configuration as a file URL, existing file path, or valid base64 — no Secret/Public Key file exists for the given keyConfUrl, so key loading fails.","triggerScenarios":"Setting tokenSecretKey/tokenPublicKey to a path that doesn't exist on the broker filesystem, a relative path resolved against the wrong working directory, or a typo'd value that fails both the URL/file lookup and the Base64.isBase64 check.","commonSituations":"Kubernetes/container deployments where the key file was mounted at a different path than configured; using an absolute path from a dev machine on the server; forgetting to mount the secret volume; missing `file://` handling or environment-specific config override.","solutions":["Fix the secret/public key path or supply the key as base64","Ensure the key file exists and is readable by the broker"],"exampleFix":"# before (broker.conf)\ntokenSecretKey=/home/me/keys/secret.key   # file not present on broker\n# after\ntokenSecretKey=file:///pulsar/secret/secret.key  # mounted + verified\n# or inline:\ntokenSecretKey=MIIBIjANBgkq...","handlingStrategy":"validation","validationCode":"java.nio.file.Path p = java.nio.file.Path.of(keyPath);\nif (!java.nio.file.Files.isRegularFile(p) || !java.nio.file.Files.isReadable(p))\n    throw new IllegalStateException(\"key file missing or unreadable: \" + p.toAbsolutePath());","typeGuard":"boolean keyFileUsable(String path) { return path != null && java.nio.file.Files.isRegularFile(java.nio.file.Path.of(path)) && java.nio.file.Files.isReadable(java.nio.file.Path.of(path)); }","tryCatchPattern":"try { byte[] key = AuthTokenUtils.readKeyFromUrl(url); } catch (IllegalArgumentException e) { log.error(\"key file/URL not found: {}\", e.getMessage()); throw e; }","preventionTips":["Use absolute paths in broker.conf","In containers, mount the secret and verify the mount path matches config","Add a startup pre-flight check that reads the key file","Verify file permissions for the broker's service user"],"tags":["authentication","configuration","file-not-found","java"],"backgroundTag":"key-file-not-found","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}