ory/kratos · error

you must provide `secrets.pagination` for FIPS compliance

Error message

you must provide `secrets.pagination` for FIPS compliance

What it means

When FIPS 140 mode is enabled (fips140.Enabled()), the Ory config validation requires explicitly configured pagination secrets, because FIPS-compliant random generation cannot safely derive/default these secrets. If the `secrets.pagination` config key has no values, config validation fails.

Solutions

1. Add `secrets.pagination` to your config: e.g. `secrets: { pagination: ["<32+char-random-string>"] }`
2. Or set the corresponding env/key in your secret manager so it appears in config
3. Generate secrets with a FIPS-approved RNG (e.g. `openssl rand` with FIPS provider)
4. Review the other FIPS-required keys (secrets.cipher, secrets.cookie, secrets.default) and set them all at once

Example fix

// before (config.yml)
secrets: {}
// after (config.yml)
secrets:
  pagination:
    - "a-very-long-random-pagination-secret-value"
  cipher:
    - "a-very-long-random-cipher-secret"
  cookie:
    - "a-very-long-random-cookie-secret"
  default:
    - "a-very-long-random-default-secret"

if fipsEnabled && len(cfg.Secrets.Pagination) == 0 {
  return errors.New("secrets.pagination is required in FIPS mode")
}

When it happens

Trigger: Running the server (driver.New with validation) with FIPS 140 mode enabled (e.g. GODEBUG=fips140=on or equivalent flag) and no `secrets.pagination` array set in config/env.

Common situations: Migrating a deployment to a FIPS-hardened build/image where secrets that used to be auto-generated must now be provided; copying a config from a non-FIPS environment.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• you must provide `secrets.cipher` for FIPS compliance
• you must provide `secrets.cookie` for FIPS compliance
• you must provide `secrets.default` for FIPS compliance
• configuration value not a valid URL
• configuration value is not a valid URL

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/4de09cd22984eb7e. Report an issue: GitHub.

Appendix: source

Thrown at driver/config/config.go:435

		}),
	}, opts...)

	p, err := configx.New(ctx, embedx.ConfigSchema, opts...)
	if err != nil {
		return nil, err
	}

	l.UseConfig(p)

	c = NewCustom(l, p, stdOutOrErr, ctxer)

	if !p.SkipValidation() {
		if err := c.validateIdentitySchemas(ctx); err != nil {
			return nil, err
		}
		if fips140.Enabled() {
			if len(p.Strings(ViperKeySecretsPagination)) == 0 {
				return nil, errors.New("you must provide `secrets.pagination` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCipher)) == 0 {
				return nil, errors.New("you must provide `secrets.cipher` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCookie)) == 0 {
				return nil, errors.New("you must provide `secrets.cookie` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsDefault)) == 0 {
				return nil, errors.New("you must provide `secrets.default` for FIPS compliance")
			}
		}
	}

	return c, nil
}

func NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {
	l.UseConfig(p)

View on GitHub (pinned to b86338da04)