kestra-io/kestra · error · KestraRuntimeException

Tenant id can only be 'main'

Error message

Tenant id can only be 'main'

What it means

Thrown by TenantIdSelectorService in Kestra OSS when a non-blank tenant id other than 'main' is supplied. OSS is single-tenant and only allows the MAIN_TENANT ('main'); any other tenant id is rejected with KestraRuntimeException. The EE edition overrides getTenantId to permit arbitrary tenants via getTenantIdAndAllowEETenants.

Source

Thrown at cli/src/main/java/io/kestra/cli/services/TenantIdSelectorService.java:17

package io.kestra.cli.services;

import org.apache.commons.lang3.StringUtils;

import io.kestra.core.exceptions.KestraRuntimeException;

import jakarta.inject.Singleton;

import static io.kestra.core.tenant.TenantService.MAIN_TENANT;

@Singleton
public class TenantIdSelectorService {

    //For override purpose in Kestra EE
    public String getTenantId(String tenantId) {
        if (StringUtils.isNotBlank(tenantId) && !MAIN_TENANT.equals(tenantId)) {
            throw new KestraRuntimeException("Tenant id can only be 'main'");
        }
        return MAIN_TENANT;
    }

    public String getTenantIdAndAllowEETenants(String tenantId) {
        if (StringUtils.isNotBlank(tenantId)) {
            return tenantId;
        }
        return MAIN_TENANT;
    }

    public void createTenant(String tenantId) {
        //for override purpose
    }
}

View on GitHub (pinned to 823fada927)

Solutions

1. On OSS, omit --tenant or pass --tenant main.
2. If you need multiple tenants, run Kestra Enterprise Edition.
3. Audit env vars / config for a stale tenant id after switching editions.

Example fix

# before
kestra flow test myflow.yaml --tenant acme
# after (OSS)
kestra flow test myflow.yaml --tenant main

if (StringUtils.isNotBlank(tenantId) && !MAIN_TENANT.equals(tenantId)) {
  throw new IllegalArgumentException('OSS only allows tenant "main"; got ' + tenantId);
}

When it happens

Trigger: A CLI command or service calls getTenantId(tenantId) where tenantId is non-blank and != 'main'; the guard throws KestraRuntimeException("Tenant id can only be 'main'").

Common situations: Running OSS with --tenant acme, an EE-configured value left in env after downgrading to OSS, a script assuming multi-tenancy on OSS, or a misconfigured tenant header.

Related errors

• Missing required options '--plugins' or environment variable
• Missing required options '--plugins' or environment variable
• No log store configured through the application property '%s
• Digest authentication requires both `username` and `password
• Digest authentication requires an absolute URI with a host.

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/7ddd9bb7f86e1afa. Report an issue: GitHub.