pathwaycom/pathway · error · ValueError

SchemaRegistrySettings: 'token_authorization' is mutually ex

Error message

SchemaRegistrySettings: 'token_authorization' is mutually exclusive with 'username'/'password'. Pick one authentication method.

What it means

SchemaRegistrySettings rejects configurations that specify both token-based auth ('token_authorization') and username/password basic auth at the same time. Only one authentication method may be active, because the underlying HTTP client would have to pick one Authorization header and the user's intent would be ambiguous. The check runs in __post_init__ as soon as any of the three fields overlap.

Source

Thrown at python/pathway/internals/_io_helpers.py:306

                    f"string; got {url!r}."
                )
        for field_name in ("token_authorization", "username", "password", "proxy"):
            value = getattr(self, field_name)
            if value is not None and not isinstance(value, str):
                raise TypeError(
                    f"SchemaRegistrySettings.{field_name} must be a str, "
                    f"got {type(value).__name__}."
                )
        if self.password is not None and self.username is None:
            raise ValueError(
                "SchemaRegistrySettings: 'password' was provided without "
                "'username'. Both are needed for username/password "
                "authentication."
            )
        if self.token_authorization is not None and (
            self.username is not None or self.password is not None
        ):
            raise ValueError(
                "SchemaRegistrySettings: 'token_authorization' is mutually "
                "exclusive with 'username'/'password'. Pick one "
                "authentication method."
            )
        if self.headers is not None:
            for i, header in enumerate(self.headers):
                if not isinstance(header, SchemaRegistryHeader):
                    raise TypeError(
                        f"SchemaRegistrySettings.headers[{i}] must be a "
                        f"SchemaRegistryHeader instance, got "
                        f"{type(header).__name__}. Use "
                        f"pw.io.kafka.SchemaRegistryHeader(key=..., value=...)."
                    )
        if self.timeout is not None:
            if not isinstance(self.timeout, datetime.timedelta):
                raise TypeError(
                    f"SchemaRegistrySettings.timeout must be a "
                    f"datetime.timedelta, got {type(self.timeout).__name__}."

View on GitHub (pinned to fa2f74a464)

Solutions

1. Keep only one auth method: either token_authorization or username+password.
2. Audit config merging (base + overlay dicts, .env files) so credentials from the old method are unset.
3. Branch explicitly on which credential is available in the environment.

Example fix

# before
settings = pw.io.kafka.SchemaRegistrySettings(
    urls=["http://registry:8081"],
    token_authorization=os.environ["TOKEN"],
    username=os.environ.get("REGISTRY_USER"),   # leftover from old setup
    password=os.environ.get("REGISTRY_PASS"),
)

# after
if os.environ.get("TOKEN"):
    auth = {"token_authorization": os.environ["TOKEN"]}
else:
    auth = {
        "username": os.environ["REGISTRY_USER"],
        "password": os.environ["REGISTRY_PASS"],
    }
settings = pw.io.kafka.SchemaRegistrySettings(
    urls=["http://registry:8081"], **auth
)

token = os.environ.get("REGISTRY_TOKEN")
user = os.environ.get("REGISTRY_USERNAME")
pwd = os.environ.get("REGISTRY_PASSWORD")
if token and (user or pwd):
    raise ValueError("choose one auth method: token OR username/password")
auth = {"token_authorization": token} if token else {"username": user, "password": pwd}
settings = pw.io.kafka.SchemaRegistrySettings(urls=urls, **{k: v for k, v in auth.items() if v is not None})

When it happens

Trigger: SchemaRegistrySettings(urls=[...], token_authorization='tkn', username='user', password='pass'); building settings from a dict that merges defaults from two environments (one token-based, one basic-auth); copy-pasting an example and adding a token on top of existing credentials.

Common situations: Migrating a pipeline from basic auth to token auth while old credential variables remain set; layered configuration (base config sets username/password, an overlay adds token_authorization); CI environments leaking both sets of credentials into env vars.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• SchemaRegistrySettings: 'password' was provided without 'use
• SchemaRegistrySettings.urls[{i}] must be a non-empty string;
• SchemaRegistrySettings.{field_name} must be a str, got {type
• 'subject' must be a non-empty string; got an empty string. S
• Failed to install dependencies

AI-assisted analysis of pathwaycom/pathway@fa2f74a464 (2026-08-15). Data as JSON: /api/errors/d263ec4b7b94d1ad. Report an issue: GitHub.