kestra-io/kestra · error · Exception

Unable to use a `SECRET` input/output as encryption is not c

Error message

Unable to use a `SECRET` input/output as encryption is not configured

What it means

Error "Unable to use a `SECRET` input/output as encryption is not configured" thrown in kestra-io/kestra.

Source

Thrown at core/src/main/java/io/kestra/core/runners/FlowInputOutput.java:544

        }

        final Type elementType = data instanceof ItemTypeInterface itemTypeInterface ? itemTypeInterface.getItemType() : null;

        return Optional.of(
            new AbstractMap.SimpleEntry<>(
                data.getId(),
                parseType(execution, data.getType(), data.getId(), elementType, current, data)
            )
        );
    }

    private Object parseType(Execution execution, Type type, String id, Type elementType, Object current, Data data) throws Exception {
        try {
            return switch (type) {
                case SELECT, STRING, EMAIL -> current.toString();
                case SECRET -> {
                    if (secretKey.isEmpty()) {
                        throw new Exception("Unable to use a `SECRET` input/output as encryption is not configured");
                    }
                    if (data instanceof SecretInput secretInput) {
                        secretInput.validate(current.toString());
                    }
                    String encrypted = EncryptionService.encrypt(secretKey.get(), current.toString());
                    yield EncryptedString.from(encrypted);
                }
                case INT -> TypeConverter.toInteger(current);
                // Assuming that after the render we must have a double/int, so we can safely use its toString representation
                case FLOAT -> TypeConverter.toFloat(current);
                case BOOL -> TypeConverter.toBoolean(current);
                case DATETIME -> TypeConverter.toInstant(current);
                case DATE -> TypeConverter.toLocalDate(current);
                case TIME -> TypeConverter.toLocalTime(current);
                case DURATION -> TypeConverter.toDuration(current);
                case FILE -> {
                    URI uri = URI.create(current.toString().replace(File.separator, "/"));

View on GitHub (pinned to 823fada927)

Solutions

1. Configure encryption by setting the 'kestra.encryption.secret-key' property so SECRET inputs/outputs can be used.
2. Change the input/output type from SECRET to a non-secret type if encryption is not required.

When it happens

Trigger: Thrown at core/src/main/java/io/kestra/core/runners/FlowInputOutput.java:544 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/787ddf3e81e91e7f. Report an issue: GitHub.