grpc/grpc-java · error · GrpcServiceParseException

Failed to parse channel credentials: " + e.getMessage()

Error message

Failed to parse channel credentials: " + e.getMessage()

What it means

While parsing a channel-credentials plugin proto, an InvalidProtocolBufferException was raised (malformed bytes/fields inside the Any payload), and channelCredsFromProto rethrows it as GrpcServiceParseException with the message "Failed to parse channel credentials: " plus the cause text. It signals the credentials config data itself is corrupt or not the expected message type.

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:238

          }
          return Optional.of(ConfiguredChannelCredentials.create(
              XdsChannelCredentials.create(fallbackCreds.get().channelCredentials()),
              new ProtoChannelCredsConfig(typeUrl, cred)));
        case LOCAL_CREDENTIALS_TYPE_URL:
          throw new GrpcServiceParseException(
              "LocalCredentials are not supported in grpc-java. "
                  + "See https://github.com/grpc/grpc-java/issues/8928");
        case TLS_CREDENTIALS_TYPE_URL:
          // For this PR, we establish this structural skeleton,
          // but throw an GrpcServiceParseException until the exact stream conversions are
          // merged.
          throw new GrpcServiceParseException(
              "TlsCredentials input stream construction pending.");
        default:
          return Optional.empty();
      }
    } catch (InvalidProtocolBufferException e) {
      throw new GrpcServiceParseException("Failed to parse channel credentials: " + e.getMessage());
    }
  }

  private static ConfiguredChannelCredentials extractChannelCredentials(
      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {
    for (Any cred : channelCredentialPlugins) {
      Optional<ConfiguredChannelCredentials> parsed = channelCredsFromProto(cred);
      if (parsed.isPresent()) {
        return parsed.get();
      }
    }
    throw new GrpcServiceParseException("No valid supported channel_credentials found");
  }

  private static Optional<CallCredentials> callCredsFromProto(Any cred)
      throws GrpcServiceParseException {
    if (cred.is(AccessTokenCredentials.class)) {
      try {

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Fix the credentials Any payload so it decodes to the expected message for its type_url (read the embedded cause message for the exact decode failure)
2. Regenerate the bootstrap/config from a trusted template or the control plane rather than hand-editing
3. Verify proto versions match between the config producer and grpc-java's xds protos

Example fix

// before (corrupt payload)
{"type_url": ".../TlsCredentials", "value": "!!!not-base64!!!"}
// after
{"type_url": ".../TlsCredentials", "value": "Cg4KC..."}

// Validate the Any payload decodes before handing it to the parser
try {
  if (cred.is(TlsCredentials.class)) cred.unpack(TlsCredentials.class);
} catch (InvalidProtocolBufferException e) {
  throw new IllegalArgumentException("Corrupt credentials payload: " + e.getMessage());
}

boolean isDecodableCredentials(Any cred) {
  try { cred.unpack(TlsCredentials.class); return true; }
  catch (InvalidProtocolBufferException e) { return false; }
}

try {
  channel = XdsChannelCredentials.create(config);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().startsWith("Failed to parse channel credentials")) {
    log.error("Bad credentials proto: {}", e.getMessage()); // regenerate config
  } else throw e;
}

When it happens

Trigger: channelCredsFromProto calls cred.unpack(...) (or value parsing) inside the try block and the Any payload cannot be deserialized into the expected credentials message; reached via fallbackCreds or parsed from extractChannelCredentials.

Common situations: Hand-edited bootstrap JSON with wrong base64 for the credentials value; control plane serializing an unexpected message type under a credentials type_url; version skew where proto definitions differ between producer and grpc-java.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Invalid message type: ${unpackedMessage.getClass()}
• ${structOrError.getErrorDetail()}
• Invalid Resource in address proto
• Unsupported: GrpcService must have GoogleGrpc, got: ${grpcSe
• Unsupported fallback credentials type for XdsCredentials

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/50ec5b5279fa1e66. Report an issue: GitHub.