grpc/grpc-java · error · GrpcServiceParseException

No valid supported channel_credentials found

Error message

No valid supported channel_credentials found

What it means

extractChannelCredentials iterates every Any in channel_credentials_plugins and asks channelCredsFromProto to parse it; if none yields a ConfiguredChannelCredentials (unsupported type_url hits the default case returning Optional.empty()), the parser concludes no usable channel credentials were supplied and throws GrpcServiceParseException "No valid supported channel_credentials found".

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:250

          throw new GrpcServiceParseException(
              "TlsCredentials input stream construction pending.");
        default:
          return Optional.empty();
      }
    } catch (InvalidProtocolBufferException e) {
      throw new GrpcServiceParseException("Failed to parse channel credentials: " + e.getMessage());
    }
  }

  private static ConfiguredChannelCredentials extractChannelCredentials(
      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {
    for (Any cred : channelCredentialPlugins) {
      Optional<ConfiguredChannelCredentials> parsed = channelCredsFromProto(cred);
      if (parsed.isPresent()) {
        return parsed.get();
      }
    }
    throw new GrpcServiceParseException("No valid supported channel_credentials found");
  }

  private static Optional<CallCredentials> callCredsFromProto(Any cred)
      throws GrpcServiceParseException {
    if (cred.is(AccessTokenCredentials.class)) {
      try {
        AccessTokenCredentials accessToken = cred.unpack(AccessTokenCredentials.class);
        if (accessToken.getToken().isEmpty()) {
          throw new GrpcServiceParseException("Missing or empty access token in call credentials.");
        }
        return Optional
            .of(new SecurityAwareAccessTokenCredentials(MoreCallCredentials.from(OAuth2Credentials
                .create(new AccessToken(accessToken.getToken(), new Date(Long.MAX_VALUE))))));
      } catch (InvalidProtocolBufferException e) {
        throw new GrpcServiceParseException(
            "Failed to parse access token credentials: " + e.getMessage());
      }
    }

View on GitHub (pinned to 64daddc1f3)

Solutions

  1. Ensure the config includes channel_credentials_plugins with a supported type (google_default, tls, xds, insecure)
  2. Check the type_url strings against this grpc-java version's constants; fix typos or upgrade grpc-java if a newer type is needed
  3. Validate the bootstrap JSON against the gRPC xDS bootstrap schema before feeding it to the channel builder

Example fix

// before: plugins with unknown type_url
"channel_credentials_plugins": [{"type_url": ".../UnknownCredentials"}]
// after
"channel_credentials_plugins": [{"type_url": "type.googleapis.com/grpc.gcp.relay.GoogleDefaultCredentials"}]
Defensive patterns

Strategy: validation

Validate before calling

// Validate that at least one supported credentials plugin exists before building the channel
boolean hasSupported = config.getChannelCredentialsPluginsList().stream()
    .anyMatch(a -> KNOWN_TYPE_URLS.stream().noneMatch(u -> a.getTypeUrl().contains(u)) == false);
if (!hasSupported) throw new IllegalArgumentException("No supported channel_credentials plugins");

Type guard

boolean hasUsableChannelCreds(ChannelCredentialsConfig cfg) {
  return cfg != null
    && cfg.getChannelCredentialsPluginsCount() > 0
    && cfg.getChannelCredentialsPluginsList().stream()
        .anyMatch(a -> a.getTypeUrl() != null);
}

Try / catch

try {
  ChannelCredentials creds = XdsChannelCredentials.create(bootstrap);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().contains("No valid supported channel_credentials")) {
    creds = InsecureChannelCredentials.create(); // or fail fast with clearer message
  } else throw e;
}

Prevention

When it happens

Trigger: channelCreds (called by the top-level parsed method) receives a credentials config whose channel_credentials_plugins list is empty, or contains only plugins with unrecognized type_urls (channelCredsFromProto returns empty for all).

Common situations: Bootstrap file missing the channel_credentials section entirely; typo'd or future-version type_url not known to this grpc-java version; config generated for a language supporting credential types grpc-java does not.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/e9b2ebdd797fde00. Report an issue: GitHub.