elsa-workflows/elsa-core · error · InvalidOperationException

Secret ' ' was not found.

Error message

Secret '{reference.Name}' was not found.

What it means

DefaultSecretResolver.ResolveAsync fetches the secret by name via ISecretManager.GetAsync and throws InvalidOperationException when it returns null. Unlike GetExistingAsync this is the public resolution path used by activities/configuration binding. It means no usable secret exists under that reference name.

Solutions

1. Verify the secret name exists (list secrets) and correct the reference.
2. Create the missing secret.
3. Check the environment/database the app is connected to.
4. Confirm the secret is not soft-deleted (Deleted status is excluded).

Example fix

// before
var conn = await resolver.ResolveAsync(new SecretReference("Db_Connection"));
// after
var secret = await secretManager.GetAsync("Db_Connection");
if (secret is null)
    throw new InvalidOperationException("Secret 'Db_Connection' must be provisioned before startup.");
var conn = await resolver.ResolveAsync(new SecretReference("Db_Connection"));

var secret = await secretManager.GetAsync(reference.Name, ct);
if (secret is null) throw new InvalidOperationException($"Secret '{reference.Name}' is missing; provision it first.");

bool IsResolvable(Secret? s) => s is { Status: SecretStatus.Active, LatestActiveVersion: not null };

try { var value = await resolver.ResolveAsync(reference, ct); }
catch (InvalidOperationException ex) when (ex.Message.Contains("was not found")) { logger.LogError(ex, "Secret {Name} missing in {Env}", reference.Name, env.Name); throw; }

When it happens

Trigger: Resolving a SecretReference whose name matches no secret; secret soft-deleted (status Deleted filtered from lookups); store not registered.

Common situations: Typo in secret reference; secret removed after a cleanup; environment promotion forgot to create the secret; tenancy/scope mismatch hiding the secret.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Secret ' ' was not found.
• Secret ' ' could not be resolved.
• The configured secret binding could not be resolved.
• A configuration key is required.
• A managed secret writer returned the live secret reference…

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/bd21cf6bb7051176. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.Secrets/Services/DefaultSecretResolver.cs:11

namespace Elsa.Secrets.Services;

public class DefaultSecretResolver(ISecretManager secretManager) : ISecretResolver
{
    public Task<string> ResolveAsync(string name, CancellationToken cancellationToken = default) => ResolveAsync(new SecretReference(name), cancellationToken);

    public async Task<string> ResolveAsync(SecretReference reference, CancellationToken cancellationToken = default)
    {
        var secret = await secretManager.GetAsync(reference.Name, cancellationToken);
        if (secret == null)
            throw new InvalidOperationException($"Secret '{reference.Name}' was not found.");

        if (!string.IsNullOrWhiteSpace(reference.TypeName) && !string.Equals(secret.TypeName, reference.TypeName, StringComparison.OrdinalIgnoreCase))
            throw new InvalidOperationException($"Secret '{reference.Name}' is not compatible with required type '{reference.TypeName}'.");

        if (!string.IsNullOrWhiteSpace(reference.Scope) && !string.Equals(secret.Scope, reference.Scope, StringComparison.OrdinalIgnoreCase))
            throw new InvalidOperationException($"Secret '{reference.Name}' is not compatible with required scope '{reference.Scope}'.");

        var payload = await secretManager.ResolvePayloadAsync(secret, cancellationToken);
        return payload.Value!;
    }
}

View on GitHub (pinned to fe9217bdfa)