elsa-workflows/elsa-core · error · InvalidOperationException

The configured secret binding could not be resolved.

Error message

The configured secret binding could not be resolved.

What it means

The ConfigurationSecretBindingResolver reads a secret from IConfiguration using the binding's Reference as a configuration key. It throws when the resolved value is null, empty, or whitespace, meaning the configuration path referenced by the SecretBinding does not yield a usable secret value.

Solutions

1. Add the secret value at the exact configuration path referenced by binding.Reference (e.g. dotnet user-secrets set or env var).
2. Verify the Reference string matches the configuration key exactly (section separators ':', correct environment).
3. Check which configuration sources are registered/loaded in this environment (appsettings.json, environment, user secrets, key vault provider).
4. If the key was renamed, update the stored connection's SecretBinding reference to the new path.

Example fix

// before (appsettings.json missing the value)
{ }
// after
{ "ExternalAuth": { "MyIdp": { "ClientSecret": "s3cr3t" } } }
// matching binding reference: "ExternalAuth:MyIdp:ClientSecret"

// Before resolving, verify the config key exists and is non-empty
var value = configuration[binding.Reference];
if (string.IsNullOrWhiteSpace(value))
    throw new InvalidOperationException($"Configuration key '{binding.Reference}' is missing or empty.");

try
{
    var resolved = await resolver.ResolveAsync(binding, ct);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("could not be resolved"))
{
    logger.LogError(ex, "Secret missing in configuration for reference {Reference}", binding.Reference);
}

When it happens

Trigger: Thrown from ResolveAsync when configuration[binding.Reference] returns null/whitespace: the key is absent from appsettings/environment variables, the value is an empty string, the key is misspelled or the wrong case-sensitive path, or the configuration provider section was not loaded.

Common situations: Running without the environment variable that production uses; appsettings.{Environment}.json not loaded; key renamed in config while stored SecretBinding references the old path; container deployment missing the secret mount; testing locally without the User Secrets entry.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• The configured secret binding could not be resolved.
• The secret binding selects a different resolver type.
• The secret binding reference is required.
• Configuration connection
• The configured secret binding is invalid.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/ae6394513612c533. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.ExternalAuthentication/Services/ConfigurationSecretBindingResolver.cs:29

{
    public const string ResolverType = "configuration";
    public string Type => ResolverType;

    public ValueTask<SecretBindingState> GetStateAsync(SecretBinding binding, CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        EnsureType(binding);
        var configured = !string.IsNullOrWhiteSpace(configuration[binding.Reference]);
        return ValueTask.FromResult(new SecretBindingState(configured, configured));
    }

    public ValueTask<ResolvedSecretBinding> ResolveAsync(SecretBinding binding, CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        EnsureType(binding);
        var value = configuration[binding.Reference];
        if (string.IsNullOrWhiteSpace(value))
            throw new InvalidOperationException("The configured secret binding could not be resolved.");
        return ValueTask.FromResult(new ResolvedSecretBinding(new(value), hasher.Hash($"{ResolverType}:{binding.Reference}:{value}")));
    }

    private static void EnsureType(SecretBinding binding)
    {
        if (!string.Equals(binding.ResolverType, ResolverType, StringComparison.Ordinal) || string.IsNullOrWhiteSpace(binding.Reference))
            throw new InvalidOperationException("The configured secret binding is invalid.");
    }
}

View on GitHub (pinned to fe9217bdfa)