grpc/grpc-java · error · IllegalArgumentException

At least one credential is required

Error message

At least one credential is required

What it means

ChoiceServerCredentials.create() builds a server credentials object that tries its options in preference order. It requires at least one ServerCredentials; calling create() with an empty varargs array throws IllegalArgumentException.

Source

Thrown at api/src/main/java/io/grpc/ChoiceServerCredentials.java:36

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;

/**
 * Provides a list of {@link ServerCredentials}, where any one may be used. The credentials are in
 * preference order.
 */
public final class ChoiceServerCredentials extends ServerCredentials {
  /**
   * Constructs with the provided {@code creds} as options, with preferred credentials first.
   *
   * @throws IllegalArgumentException if no creds are provided
   */
  public static ServerCredentials create(ServerCredentials... creds) {
    if (creds.length == 0) {
      throw new IllegalArgumentException("At least one credential is required");
    }
    return new ChoiceServerCredentials(creds);
  }

  private final List<ServerCredentials> creds;

  private ChoiceServerCredentials(ServerCredentials... creds) {
    for (ServerCredentials cred : creds) {
      if (cred == null) {
        throw new NullPointerException();
      }
    }
    this.creds = Collections.unmodifiableList(new ArrayList<>(Arrays.asList(creds)));
  }

  /** Non-empty list of credentials, in preference order. */
  public List<ServerCredentials> getCredentialsList() {
    return creds;

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Always pass at least one ServerCredentials, e.g. TlsServerCredentials.create() or InsecureServerCredentials.create() as a fallback
2. Validate the credentials list is non-empty before calling create() and fail with a descriptive configuration error
3. Check the server configuration/cert paths so at least one credential can be constructed

Example fix

// before
ServerCredentials creds = ChoiceServerCredentials.create(serverCredsList.toArray(new ServerCredentials[0]));
// after
if (serverCredsList.isEmpty()) {
  serverCredsList.add(InsecureServerCredentials.create()); // or throw a clear config error
}
ServerCredentials creds = ChoiceServerCredentials.create(serverCredsList.toArray(new ServerCredentials[0]));

if (serverCredsList == null || serverCredsList.isEmpty()) {
  throw new IllegalArgumentException("At least one ServerCredentials must be configured");
}
ServerCredentials creds = ChoiceServerCredentials.create(serverCredsList.toArray(new ServerCredentials[0]));

try {
  ServerCredentials creds = ChoiceServerCredentials.create(credArray);
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("At least one credential is required")) {
    creds = InsecureServerCredentials.create(); // or surface a config error
  } else throw e;
}

When it happens

Trigger: Calling ServerCredentials.create() / ChoiceServerCredentials.create() with zero arguments, typically by spreading an empty collection of server credentials (e.g..toArray(new ServerCredentials[0])) or by omitting arguments.

Common situations: Building server credentials from config where TLS cert/key entries are missing; feature flags disabling all credential sources; migration code that used to pass TlsServerCredentials plus a fallback but the fallback was removed.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• At least one credential is required
• Invalid host or port:
• ${result.error}
• Subclass failed to hide static factory
• A key manager is required

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/ca580ea991c8ee0c. Report an issue: GitHub.