ory/hydra · critical

global secret is not configured

Error message

global secret is not configured

What it means

DefaultProvider.GetGlobalSecret reads the system secret(s) from configuration (KeyGetSystemSecret). If none are configured it returns this error, because Hydra needs a global secret for encrypting/decrypting cookies and database-stored secrets. GetCookieSecrets and validation paths call it during startup.

Source

Thrown at driver/config/provider_fosite.go:25

	"context"
	"strings"
	"time"

	"github.com/pkg/errors"

	"github.com/ory/hydra/v2/fosite"
	"github.com/ory/hydra/v2/fosite/token/jwt"
	"github.com/ory/hydra/v2/x"
)

var _ fosite.GlobalSecretProvider = (*DefaultProvider)(nil)

func (p *DefaultProvider) GetGlobalSecret(ctx context.Context) ([]byte, error) {
	secrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)

	if len(secrets) == 0 {
		p.l.Error("The system secret is not configured. Please provide one in the configuration file or environment variables.")
		return nil, errors.New("global secret is not configured")
	}

	secret := secrets[0]
	if len(secret) < 16 {
		p.l.Errorf("System secret must be undefined or have at least 16 characters but only has %d characters.", len(secret))
		return nil, errors.New("global secret is too short")
	}

	return x.HashStringSecret(secret), nil
}

var _ fosite.RotatedGlobalSecretsProvider = (*DefaultProvider)(nil)

func (p *DefaultProvider) GetRotatedGlobalSecrets(ctx context.Context) ([][]byte, error) {
	secrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)

	if len(secrets) < 2 {
		return nil, nil

View on GitHub (pinned to 4174065ffb)

Solutions

1. Set `secrets.system` in the config to at least one 16+ character secret, ideally generated with `openssl rand -base64 32`
2. Set the environment variable ORY_HYDRA_SECRETS_SYSTEM with the generated value
3. Persist the secret (secret manager / encrypted storage) so it stays stable across restarts — changing it invalidates stored encrypted data

Example fix

// before (hydra.yml)
secrets: {}
// after
secrets:
  system:
    - "A-base64-or-random-string-of-at-least-16-chars"

if len(os.Getenv("ORY_HYDRA_SECRETS_SYSTEM")) == 0 {
    return errors.New("ORY_HYDRA_SECRETS_SYSTEM must be set before starting Hydra")
}

When it happens

Trigger: Calling GetGlobalSecret (directly or via GetCookieSecrets / startup validation) when the `secrets.system` config array is empty — no secret in the config file and none in the ORY_HYDRA_SECRETS_SYSTEM environment variable.

Common situations: New Hydra install without secrets.system set; Docker deployment missing the ORY_HYDRA_SECRETS_SYSTEM env var; config file that defines only secrets.cookie.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• issuer URL must be set unless development mode is enabled
• global secret is too short
• unsupported DSN type
• issuer URL scheme must be HTTPS unless development mode is e
• The DSN connection string looks like a SQLite connection, bu

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/814a1663d8dcffd8. Report an issue: GitHub.