kestra-io/kestra · error · PebbleException

The 'secret' function expects an argument 'key'.

Error message

The 'secret' function expects an argument 'key'.

What it means

The secret() function requires a 'key' argument that names the secret to retrieve. The getSecretKey() method checks for the presence of this argument in the args map before proceeding. If the argument is missing entirely (not passed, or passed as null in a way that the key is absent from the map), the function throws immediately.

Source

Thrown at core/src/main/java/io/kestra/core/runners/pebble/functions/SecretFunction.java:142

            addSecretConsumer.accept(value);
        } catch (Exception e) {
            log.warn("Unable to get secret consumer", e);
        }
    }

    @Override
    public Map<String, String> getArgumentDefaults() {
        HashMap<String, String> defaults = new HashMap<>();
        defaults.put(KEY_ARG, "'MY_SECRET'");
        defaults.put(NAMESPACE_ARG, "flow.namespace");
        defaults.put(SUBKEY_ARG, null);
        defaults.put(FULL_ARG, null);
        return defaults;
    }

    protected String getSecretKey(Map<String, Object> args, PebbleTemplate self, int lineNumber) {
        if (!args.containsKey(KEY_ARG)) {
            throw new PebbleException(null, "The 'secret' function expects an argument 'key'.", lineNumber, self.getName());
        }

        return (String) args.get(KEY_ARG);
    }
}

View on GitHub (pinned to 823fada927)

Solutions

1. Always pass the key argument first: {{ secret('MY_SECRET') }} or {{ secret(key='MY_SECRET') }}.
2. Ensure any dynamic expression for the key resolves to a non-null string.
3. Check for typos in the argument name.

Example fix

# before
{{ secret() }}
{{ secret(name='MY_SECRET') }}

# after
{{ secret('MY_SECRET') }}
{{ secret(key='MY_SECRET') }}

# Always pass the 'key' argument as the first positional or named argument.
# Correct: {{ secret('MY_SECRET') }}
# Correct: {{ secret(key='MY_SECRET') }}
# Ensure dynamic key expressions resolve to a non-null string:
{% if inputs.secret_key is not empty %}{{ secret(inputs.secret_key) }}{% else %}MISSING_KEY{% endif %}

When it happens

Trigger: Calling {{ secret() }} with no arguments. Passing only optional arguments like {{ secret(full=true) }} without the key. A variable that was supposed to provide the key resolves to null or is misspelled so the named argument is absent.

Common situations: Misspelling 'key' as 'Key', 'name', or 'secretKey'. A dynamic key expression that evaluates to nothing and the argument is dropped. Refactoring that accidentally removed the key argument.

Related errors

• The 'subflow' function expects the arguments 'namespace' and
• The 'render' function expects an argument 'toRender'.
• The 'secret' function cannot be called with both 'subkey' an
• The 'decrypt' function expects two arguments 'key' and 'encr
• The 'encrypt' function expects two arguments 'key' and 'plai

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/16b409a6b5a0f289. Report an issue: GitHub.