juspay/hyperswitch · critical

Failed to decrypt google pay decrypt configs

Error message

Failed to decrypt google pay decrypt configs

What it means

Panic in fetch_raw_secrets (crates/router/src/configs/secrets_transformers.rs:582): GooglePayDecryptConfig::convert_to_raw_secret() failed to decrypt the Google Pay decrypt keys via the secret management client, and the expect('Failed to decrypt google pay decrypt configs') turns that Err into a panic during application startup/secret fetching. This is a fatal bootstrap failure — the router cannot load its Google Pay payment-method configuration.

Solutions

1. Verify the secret_management_client can decrypt other secrets — fix its credentials, region, and KMS key permissions first.
2. Re-encrypt and re-upload the Google Pay decrypt keys so the stored ciphertext matches the current KMS key/environment.
3. Confirm the Google Pay keys entry actually exists in the secrets store for this environment (present-but-stale config triggers this path via the Some branch).
4. Validate the stored secret's encoding/format against what GooglePayDecryptConfig::convert_to_raw_secret expects (base64, JSON structure).
5. For faster diagnosis, replace the bare expect with error context including the source error before crashing.

Example fix

// before
.expect("Failed to decrypt google pay decrypt configs"),
// after
.unwrap_or_else(|e| panic!(
    "Failed to decrypt google pay decrypt configs: {e:?} \
     (check KMS credentials and that google_pay keys are encrypted for this env)"
)),

// pre-flight: confirm the secret decrypts before startup relies on it
let decrypted = secret_management_client
    .decrypt(google_pay_keys.clone())
    .await;
if decrypted.is_err() {
    eprintln!("google pay keys undecryptable in this env — check KMS creds/key");
}

match GooglePayDecryptConfig::convert_to_raw_secret(google_pay_keys, secret_management_client).await {
    Ok(raw) => Some(raw),
    Err(e) => panic!("Failed to decrypt google pay decrypt configs: {e:?}"),
}

When it happens

Trigger: Calling convert_to_raw_secret(google_pay_keys, secret_management_client) when: the encrypted GooglePay keys in the secrets store can't be decrypted (wrong KMS key, corrupted ciphertext, missing key in store), the secret_management_client has bad credentials/region, or the base64/format of the stored secret doesn't match what the decrypt routine expects.

Common situations: Rotating KMS keys without re-encrypting stored secrets; environment mismatch (staging secret read with production credentials); misconfigured secret manager (vault/KMS) env vars; Google Pay config present in file/env config but the corresponding encrypted keys absent in the secrets store.

Related errors

• Failed to create GCP KMS client
• Failed to GCP KMS decrypt input data

AI-assisted analysis of juspay/hyperswitch@afd9284352 (2026-09-18). Data as JSON: /api/errors/e7bba8bbbca92a5f. Report an issue: GitHub.

Appendix: source

Thrown at crates/router/src/configs/secrets_transformers.rs:582

    let paze_decrypt_keys = if let Some(paze_keys) = conf.paze_decrypt_keys {
        Some(
            settings::PazeDecryptConfig::convert_to_raw_secret(paze_keys, secret_management_client)
                .await
                .expect("Failed to decrypt paze decrypt configs"),
        )
    } else {
        None
    };

    #[allow(clippy::expect_used)]
    let google_pay_decrypt_keys = if let Some(google_pay_keys) = conf.google_pay_decrypt_keys {
        Some(
            settings::GooglePayDecryptConfig::convert_to_raw_secret(
                google_pay_keys,
                secret_management_client,
            )
            .await
            .expect("Failed to decrypt google pay decrypt configs"),
        )
    } else {
        None
    };

    #[allow(clippy::expect_used)]
    let applepay_merchant_configs = settings::ApplepayMerchantConfigs::convert_to_raw_secret(
        conf.applepay_merchant_configs,
        secret_management_client,
    )
    .await
    .expect("Failed to decrypt applepay merchant configs");

    #[allow(clippy::expect_used)]
    let payment_method_auth = settings::PaymentMethodAuth::convert_to_raw_secret(
        conf.payment_method_auth,
        secret_management_client,
    )

View on GitHub (pinned to afd9284352)