{"record":{"id":"fe4511f15d0f2fe6","repo":"quarkusio/quarkus","slug":"only-one-of-client-secret-or-jwt-secret-authentica","errorCode":null,"errorMessage":"Only one of client secret or JWT secret authentication methods can be configured, but '%1$scredentials' has both a client secret and a JWT secret property set","messagePattern":"Only one of client secret or JWT secret authentication methods can be configured, but '%1\\$scredentials' has both a client secret and a JWT secret property set","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":188,"sourceCode":"            throw new ConfigurationException(\n                    String.format(\"'%sclient-id' property must be configured\", configPrefix));\n        }\n\n        Credentials creds = oidcConfig.credentials();\n        if (creds.secret().isPresent() && creds.clientSecret().value().isPresent()) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive\",\n                            configPrefix));\n        }\n        boolean clientSecretConfigured = creds.secret().isPresent()\n                || creds.clientSecret().value().isPresent()\n                || creds.clientSecret().provider().key().isPresent();\n        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()\n                || creds.jwt().secretProvider().key().isPresent();\n\n        if (clientSecretConfigured && jwtSecretConfigured) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of client secret or JWT secret authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a client secret and a JWT secret property set\",\n                            configPrefix));\n        }\n        int jwtKeyPropsCount = (creds.jwt().key().isPresent() ? 1 : 0)\n                + (creds.jwt().keyFile().isPresent() ? 1 : 0)\n                + (creds.jwt().keyStoreFile().isPresent() ? 1 : 0);\n        if (jwtKeyPropsCount > 1) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.key-file'\"\n                                    + \" or '%1$scredentials.jwt.key-store-file' can be configured\",\n                            configPrefix));\n        }\n        boolean jwtKeyConfigured = jwtKeyPropsCount == 1;\n        boolean jwtBearerOrSpiffe = creds.jwt().source() == Source.BEARER\n                || creds.jwt().source() == Source.SPIFFE_JWT;","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L170-L206","documentation":"verifyCommonConfiguration detects when both a client secret (credentials.secret / credentials.client-secret) and a JWT secret (credentials.jwt.secret / credentials.jwt.secret-provider) are configured. Client-secret (client_secret_basic/client_secret_post style) and JWT-secret (HMAC-signed JWT assertion) authentication are alternative methods, so having both set is ambiguous and rejected with a ConfigurationException.","triggerScenarios":"Startup with, for the same prefix, any of credentials.secret/client-secret.value/client-secret.provider set AND any of credentials.jwt.secret/jwt.secret-provider.key set.","commonSituations":"Copying credential blocks from examples for different auth styles; an old HMAC JWT config left in place after switching to client-secret auth; team members adding JWT auth on top of existing secret auth.","solutions":["Remove the credentials.jwt.* properties if you want plain client-secret authentication","Remove credentials.secret / credentials.client-secret.* if you intend to authenticate with a signed JWT secret","Decide one authentication method per client and document it to avoid future config drift"],"exampleFix":"// before\nquarkus.oidc.credentials.client-secret.value=topsecret\nquarkus.oidc.credentials.jwt.secret=jwtsigningkey\n// after\nquarkus.oidc.credentials.client-secret.value=topsecret","handlingStrategy":"validation","validationCode":"boolean clientSecret = cfg.optional(\"quarkus.oidc.credentials.client-secret.value\").isPresent()\n        || cfg.optional(\"quarkus.oidc.credentials.secret\").isPresent();\nboolean jwtSecret = cfg.optional(\"quarkus.oidc.credentials.jwt.secret\").isPresent();\nif (clientSecret && jwtSecret) {\n    throw new IllegalArgumentException(\"Configure only one of client secret or JWT secret\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    startApplication();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"JWT secret\")) {\n        LOG.error(\"Remove either credentials.client-secret.* or credentials.jwt.secret\");\n    }\n}","preventionTips":["Pick one authentication method per OIDC client and stick to it","Remove leftover jwt.secret config when switching to client-secret auth","Review OIDC config diffs in code review for mixed credential styles"],"tags":["configuration","oidc","mutually-exclusive","jwt"],"backgroundTag":"mutually-exclusive-config-properties","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}