keycloak/keycloak · error · RuntimeException

Configuration of jwt credentials is missing or incorrect for

Error message

Configuration of jwt credentials is missing or incorrect for client '{}'. Check your adapter configuration

What it means

Error "Configuration of jwt credentials is missing or incorrect for client '{}'. Check your adapter configuration" thrown in keycloak/keycloak.

Source

Thrown at core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientCredentialsProvider.java:117

        this.keyPair = keyPair;
    }

    public void setTokenTimeout(int tokenTimeout) {
        this.tokenTimeout = tokenTimeout;
    }

    protected int getTokenTimeout() {
        return tokenTimeout;
    }

    public PublicKey getPublicKey() {
        return keyPair.getPublic();
    }

    @Override
    public void init(AdapterConfig deployment, Object config) {
        if (!(config instanceof Map)) {
            throw new RuntimeException("Configuration of jwt credentials is missing or incorrect for client '" + deployment.getResource() + "'. Check your adapter configuration");
        }

        Map<String, Object> cfg = (Map<String, Object>) config;

        String clientKeystoreFile =  (String) cfg.get("client-keystore-file");
        if (clientKeystoreFile == null) {
            throw new RuntimeException("Missing parameter client-keystore-file in configuration of jwt for client " + deployment.getResource());
        }

        String clientKeystoreType = (String) cfg.get("client-keystore-type");
        KeystoreUtil.KeystoreFormat clientKeystoreFormat = clientKeystoreType==null ? KeystoreUtil.KeystoreFormat.JKS : Enum.valueOf(KeystoreUtil.KeystoreFormat.class, clientKeystoreType.toUpperCase());

        String clientKeystorePassword =  (String) cfg.get("client-keystore-password");
        if (clientKeystorePassword == null) {
            throw new RuntimeException("Missing parameter client-keystore-password in configuration of jwt for client " + deployment.getResource());
        }

        String clientKeyPassword = (String) cfg.get("client-key-password");

View on GitHub (pinned to 66c7e15a37)

Solutions

1. Add a 'client-jwt' (jwt) credentials section to the adapter configuration as a JSON object with the required keystore parameters.
2. Ensure the credentials configuration value is a map/object, not a string or other type.
3. Required keys include 'client-keystore-file' and 'client-keystore-password'; see the client-jwt adapter documentation.

When it happens

Trigger: Initializing JWT client credentials when the jwt configuration section for the client is missing or fails validation.

Common situations: Occurs when client-jwt authentication is selected but the adapter configuration lacks the required keystore parameters or contains invalid values.

AI-assisted analysis of keycloak/keycloak@66c7e15a37 (2026-08-14). Data as JSON: /api/errors/c1a8125bfeab8f39. Report an issue: GitHub.