{"id":"540685b64c511665","repo":"rails/rails","slug":"missing-required-ingress-credentials","errorCode":null,"errorMessage":"Missing required ingress credentials","messagePattern":"Missing required ingress credentials","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"actionmailbox/app/controllers/action_mailbox/base_controller.rb","lineNumber":26,"sourceCode":"    before_action :ensure_configured\n\n    private\n      def ensure_configured\n        unless ActionMailbox.ingress == ingress_name\n          head :not_found\n        end\n      end\n\n      def ingress_name\n        self.class.name.remove(/\\AActionMailbox::Ingresses::/, /::InboundEmailsController\\z/).underscore.to_sym\n      end\n\n\n      def authenticate_by_password\n        if password.present?\n          http_basic_authenticate_or_request_with name: \"actionmailbox\", password: password, realm: \"Action Mailbox\"\n        else\n          raise ArgumentError, \"Missing required ingress credentials\"\n        end\n      end\n\n      def password\n        Rails.app.credentials.dig(:action_mailbox, :ingress_password) || ENV[\"RAILS_INBOUND_EMAIL_PASSWORD\"]\n      end\n  end\nend\n","sourceCodeStart":8,"sourceCodeEnd":35,"githubUrl":"https://github.com/rails/rails/blob/817fc2a147c249180ee9b271c0e8d82d43457a3a/actionmailbox/app/controllers/action_mailbox/base_controller.rb#L8-L35","documentation":"Raises ArgumentError('Missing required ingress credentials') from ActionMailbox::BaseController#authenticate_by_password when neither Rails.application.credentials.dig(:action_mailbox, :ingress_password) nor ENV['RAILS_INBOUND_EMAIL_PASSWORD'] is set. Action Mailbox ingress controllers (for Mailgun, SendGrid, Postmark, etc.) authenticate inbound email webhooks via HTTP Basic Auth with a shared password; without it configured, the controller cannot verify the incoming mail is legitimate and refuses to process it.","triggerScenarios":"An Action Mailbox ingress endpoint (e.g., /rails/action_mailbox/mailgun/inbound_emails) receives a request but the ingress password was never set. Common when deploying Action Mailbox for the first time, or when credentials differ between environments, or when ENV var isn't set in production.","commonSituations":"New Action Mailbox setup without running rails credentials:edit to set the password; production deployment missing the RAILS_INBOUND_EMAIL_PASSWORD env var; CI/staging environments that never configured ingress credentials; Docker images that don't propagate the env var.","solutions":["Set the ingress password in credentials: EDITOR=vim bin/rails credentials:edit and add action_mailbox: ingress_password: 'your_secret'.","Or set the environment variable: export RAILS_INBOUND_EMAIL_PASSWORD=your_secret (ensure it's set in production via your hosting platform's env config).","Configure the ingress provider (Mailgun/SendGrid) to send the same password via HTTP Basic Auth username 'actionmailbox'.","Verify with Rails.application.credentials.dig(:action_mailbox, :ingress_password) in the Rails console."],"exampleFix":"# before\n# RAILS_INBOUND_EMAIL_PASSWORD not set\n# credentials lack action_mailbox.ingress_password\n\n# after - config/credentials.yml.enc\naction_mailbox:\n  ingress_password: <%= ENV[\"RAILS_INBOUND_EMAIL_PASSWORD\"] %>\n\n# then set in production env:\n# RAILS_INBOUND_EMAIL_PASSWORD=a_strong_secret","handlingStrategy":"validation","validationCode":"pwd = Rails.application.credentials.dig(:action_mailbox, :ingress_password) || ENV['RAILS_INBOUND_EMAIL_PASSWORD']\nraise 'Set RAILS_INBOUND_EMAIL_PASSWORD' if pwd.blank?","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set RAILS_INBOUND_EMAIL_PASSWORD in all environments that receive inbound email.","Store the password in encrypted credentials, not in plaintext config.","Add a deployment checklist item verifying the env var is set.","Configure the mail provider to send the same password via HTTP Basic Auth."],"tags":["action-mailbox","ingress","credentials","configuration","email"],"analyzedSha":"817fc2a147c249180ee9b271c0e8d82d43457a3a","analyzedAt":"2026-08-04T20:52:19.892Z","schemaVersion":2}