grpc/grpc-java · error · GrpcServiceParseException

Failed to parse channel credentials: " + e.getMessage()

Error message

Failed to parse channel credentials: " + e.getMessage()

What it means

While parsing a channel-credentials plugin proto, an InvalidProtocolBufferException was raised (malformed bytes/fields inside the Any payload), and channelCredsFromProto rethrows it as GrpcServiceParseException with the message "Failed to parse channel credentials: " plus the cause text. It signals the credentials config data itself is corrupt or not the expected message type.

Solutions

1. Fix the credentials Any payload so it decodes to the expected message for its type_url (read the embedded cause message for the exact decode failure)
2. Regenerate the bootstrap/config from a trusted template or the control plane rather than hand-editing
3. Verify proto versions match between the config producer and grpc-java's xds protos

Example fix

// before (corrupt payload)
{"type_url": ".../TlsCredentials", "value": "!!!not-base64!!!"}
// after
{"type_url": ".../TlsCredentials", "value": "Cg4KC..."}

// Validate the Any payload decodes before handing it to the parser
try {
  if (cred.is(TlsCredentials.class)) cred.unpack(TlsCredentials.class);
} catch (InvalidProtocolBufferException e) {
  throw new IllegalArgumentException("Corrupt credentials payload: " + e.getMessage());
}

boolean isDecodableCredentials(Any cred) {
  try { cred.unpack(TlsCredentials.class); return true; }
  catch (InvalidProtocolBufferException e) { return false; }
}

try {
  channel = XdsChannelCredentials.create(config);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().startsWith("Failed to parse channel credentials")) {
    log.error("Bad credentials proto: {}", e.getMessage()); // regenerate config
  } else throw e;
}

When it happens

Trigger: channelCredsFromProto calls cred.unpack(...) (or value parsing) inside the try block and the Any payload cannot be deserialized into the expected credentials message; reached via fallbackCreds or parsed from extractChannelCredentials.

Common situations: Hand-edited bootstrap JSON with wrong base64 for the credentials value; control plane serializing an unexpected message type under a credentials type_url; version skew where proto definitions differ between producer and grpc-java.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Invalid message type
• ${structOrError.getErrorDetail()}
• ClusterLoadAssignment has duplicate locality
• ClusterLoadAssignment has sparse priorities
• ClusterSpecifierPlugin

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/50ec5b5279fa1e66. Report an issue: GitHub.

Appendix: source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:238

          }
          return Optional.of(ConfiguredChannelCredentials.create(
              XdsChannelCredentials.create(fallbackCreds.get().channelCredentials()),
              new ProtoChannelCredsConfig(typeUrl, cred)));
        case LOCAL_CREDENTIALS_TYPE_URL:
          throw new GrpcServiceParseException(
              "LocalCredentials are not supported in grpc-java. "
                  + "See https://github.com/grpc/grpc-java/issues/8928");
        case TLS_CREDENTIALS_TYPE_URL:
          // For this PR, we establish this structural skeleton,
          // but throw an GrpcServiceParseException until the exact stream conversions are
          // merged.
          throw new GrpcServiceParseException(
              "TlsCredentials input stream construction pending.");
        default:
          return Optional.empty();
      }
    } catch (InvalidProtocolBufferException e) {
      throw new GrpcServiceParseException("Failed to parse channel credentials: " + e.getMessage());
    }
  }

  private static ConfiguredChannelCredentials extractChannelCredentials(
      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {
    for (Any cred : channelCredentialPlugins) {
      Optional<ConfiguredChannelCredentials> parsed = channelCredsFromProto(cred);
      if (parsed.isPresent()) {
        return parsed.get();
      }
    }
    throw new GrpcServiceParseException("No valid supported channel_credentials found");
  }

  private static Optional<CallCredentials> callCredsFromProto(Any cred)
      throws GrpcServiceParseException {
    if (cred.is(AccessTokenCredentials.class)) {
      try {

View on GitHub (pinned to 64daddc1f3)