pathwaycom/pathway · error · ValueError

SchemaRegistrySettings: 'password' was provided without 'use

Error message

SchemaRegistrySettings: 'password' was provided without 'username'. Both are needed for username/password authentication.

What it means

SchemaRegistrySettings enforces that basic authentication credentials come as a pair: if 'password' is provided, 'username' must also be provided. Supplying only a password is almost always a configuration mistake, since the registry client has no way to build an Authorization header from a password alone. The ValueError is raised eagerly in __post_init__.

Source

Thrown at python/pathway/internals/_io_helpers.py:298

            raise ValueError(
                "SchemaRegistrySettings requires at least one entry in 'urls'; "
                "got an empty list."
            )
        for i, url in enumerate(self.urls):
            if not isinstance(url, str) or not url:
                raise ValueError(
                    f"SchemaRegistrySettings.urls[{i}] must be a non-empty "
                    f"string; got {url!r}."
                )
        for field_name in ("token_authorization", "username", "password", "proxy"):
            value = getattr(self, field_name)
            if value is not None and not isinstance(value, str):
                raise TypeError(
                    f"SchemaRegistrySettings.{field_name} must be a str, "
                    f"got {type(value).__name__}."
                )
        if self.password is not None and self.username is None:
            raise ValueError(
                "SchemaRegistrySettings: 'password' was provided without "
                "'username'. Both are needed for username/password "
                "authentication."
            )
        if self.token_authorization is not None and (
            self.username is not None or self.password is not None
        ):
            raise ValueError(
                "SchemaRegistrySettings: 'token_authorization' is mutually "
                "exclusive with 'username'/'password'. Pick one "
                "authentication method."
            )
        if self.headers is not None:
            for i, header in enumerate(self.headers):
                if not isinstance(header, SchemaRegistryHeader):
                    raise TypeError(
                        f"SchemaRegistrySettings.headers[{i}] must be a "
                        f"SchemaRegistryHeader instance, got "

View on GitHub (pinned to fa2f74a464)

Solutions

1. Provide both username and password together.
2. Check for a misspelled or misread username variable in your config loading code.
3. If your registry uses token auth, pass token_authorization='...' instead of a password.
4. If no auth is needed, remove the password argument entirely.

Example fix

# before
settings = pw.io.kafka.SchemaRegistrySettings(
    urls=["http://registry:8081"],
    password=os.environ["REGISTRY_TOKEN"],
)

# after (token auth was the intent)
settings = pw.io.kafka.SchemaRegistrySettings(
    urls=["http://registry:8081"],
    token_authorization=os.environ["REGISTRY_TOKEN"],
)

username = os.environ.get("REGISTRY_USERNAME")
password = os.environ.get("REGISTRY_PASSWORD")
assert (username is None) == (password is None), "provide both username and password, or neither"
settings = pw.io.kafka.SchemaRegistrySettings(urls=urls, username=username, password=password)

When it happens

Trigger: SchemaRegistrySettings(urls=[...], password='secret') with no username; passing username=None explicitly while setting a password; building settings from a config dict where the username key was misspelled (e.g. 'user') and therefore defaulted to None.

Common situations: Secrets loaded from a vault/env where the username variable name differs from what the code reads (REGISTRY_USER vs SCHEMA_REGISTRY_USERNAME); refactoring settings constructors and dropping the username line; machine accounts that only provision a token being wired into username/password fields.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• SchemaRegistrySettings: 'token_authorization' is mutually ex
• SchemaRegistrySettings.urls[{i}] must be a non-empty string;
• SchemaRegistrySettings.{field_name} must be a str, got {type
• 'subject' must be a non-empty string; got an empty string. S
• Failed to install dependencies

AI-assisted analysis of pathwaycom/pathway@fa2f74a464 (2026-08-15). Data as JSON: /api/errors/9552934c7e65463d. Report an issue: GitHub.