infiniflow/ragflow · error · ConnectorMissingCredentialError

Jira credentials must include either an API token or usernam

Error message

Jira credentials must include either an API token or username/password.

What it means

ConnectorMissingCredentialError raised in load_credentials when the credentials dict yields neither an API token (jira_api_token/token/api_token) nor a username+password pair (jira_user_email/jira_username plus jira_password/password). The constructor path was fine; the credential payload itself is incomplete, so no JIRA client could be built.

Source

Thrown at common/data_source/jira/connector.py:179

                self.jira_client = JIRA(
                    server=jira_url_for_client,
                    basic_auth=(user_email, api_token),
                    options=options,
                )
            elif api_token:
                self.jira_client = JIRA(
                    server=jira_url_for_client,
                    token_auth=api_token,
                    options=options,
                )
            elif user_email and password:
                self.jira_client = JIRA(
                    server=jira_url_for_client,
                    basic_auth=(user_email, password),
                    options=options,
                )
            else:
                raise ConnectorMissingCredentialError("Jira credentials must include either an API token or username/password.")
        except Exception as exc:  # pragma: no cover - jira lib raises many types
            raise ConnectorMissingCredentialError(f"Jira: {exc}") from exc
        self._sync_timezone_from_server()
        return None

    def validate_connector_settings(self) -> None:
        """Validate connectivity by fetching basic Jira info."""
        if not self.jira_client:
            raise ConnectorMissingCredentialError("Jira")

        try:
            if self.jql_query:
                dummy_checkpoint = self.build_dummy_checkpoint()
                checkpoint_callback = self._make_checkpoint_callback(dummy_checkpoint)
                iterator = self._perform_jql_search(
                    jql=self.jql_query,
                    start=0,
                    max_results=1,

View on GitHub (pinned to 554fb1133a)

Solutions

Provide 'jira_api_token' (preferred) - it alone is sufficient since token_auth is tried first.
Or provide 'jira_user_email' plus 'jira_password' for basic auth against Jira Server.
Check the accepted key aliases in common/data_source/jira/connector.py load_credentials and rename your dict keys to one of them.
Validate required credential keys in your orchestration layer before calling load_credentials.

Example fix

# before
connector.load_credentials({'jira_user_email': 'dev@acme.com'})  # -> missing token/password

# after
connector.load_credentials({'jira_user_email': 'dev@acme.com', 'jira_api_token': os.environ['JIRA_TOKEN']})

Defensive patterns

Strategy: validation

Validate before calling

TOKEN_KEYS = ('jira_api_token', 'token', 'api_token')
USER_KEYS = ('jira_user_email', 'jira_username')
PASSWORD_KEYS = ('jira_password', 'password')

def jira_credentials_sufficient(creds: dict) -> bool:
    if any(creds.get(k) for k in TOKEN_KEYS):
        return True
    return any(creds.get(k) for k in USER_KEYS) and any(creds.get(k) for k in PASSWORD_KEYS)

Try / catch

try:
    connector.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    if 'API token or username/password' in str(e):
        raise ValueError('Jira credential form incomplete: provide an API token or user+password') from e
    raise

Prevention

Make the API token the canonical credential path; avoid collecting passwords in the UI.
Validate credential key presence in a shared pre-flight before any connector load.
Document accepted key aliases next to the credential form so users copy exact names.

When it happens

Trigger: Calling load_credentials with an empty dict, or with only a username (email but no password/token), or only a password with no username, or a dict using unrecognized key names.

Common situations: Frontend credential form submitted with only some fields; the secret store was updated and dropped the token key; confusion between key aliases (using 'apiKey' instead of 'jira_api_token').

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/e6b1e07d336230d3. Report an issue: GitHub.