prestodb/presto · critical · IllegalArgumentException

app-secret not provided in " + secretFile

Error message

app-secret not provided in " + secretFile

What it means

After successfully reading and decoding the secret file, loadAppSecret looks up the 'app-secret' key. If the value is missing or blank (emptyToNull returns null), it throws IllegalArgumentException('app-secret not provided in <path>'). The file was readable but its content does not contain the required credential key.

Source

Thrown at presto-lark-sheets/src/main/java/com/facebook/presto/lark/sheets/LarkSheetsUtil.java:54

    private LarkSheetsUtil() {}

    public static String loadAppSecret(String secretFile)
    {
        JsonCodec<Map<String, String>> codec = JsonCodec.mapJsonCodec(String.class, String.class);

        final Map<String, String> content;
        try {
            byte[] bytes = Files.readAllBytes(Paths.get(secretFile));
            content = codec.fromBytes(bytes);
        }
        catch (Exception e) {
            throw new IllegalArgumentException("Could not read secret file " + secretFile, e);
        }

        String secret = content.get("app-secret");
        if (emptyToNull(secret) == null) {
            throw new IllegalArgumentException("app-secret not provided in " + secretFile);
        }
        return secret;
    }

    public static String mask(String str)
    {
        if (str != null && str.length() > MASK_REMAIN) {
            char[] chars = str.toCharArray();
            Arrays.fill(chars, 0, chars.length - MASK_REMAIN, '*');
            return new String(chars);
        }
        return str;
    }

    public static int columnLabelToColumnIndex(String label)
    {
        requireNonNull(emptyToNull(label), "label is null or empty");

View on GitHub (pinned to 55bb57d202)

Solutions

1. Add or restore the 'app-secret' key with the real secret value in the secret file.
2. Ensure the key is spelled exactly 'app-secret' per the codec format the connector expects.
3. Regenerate the secret file using the connector's supported secret-generation tool/format.
4. Remove whitespace-only values and re-encode the file.

Example fix

// secret file before
app-id=cli_a1b2c3
// after
app-id=cli_a1b2c3
app-secret=yourLarkAppSecretValue

byte[] bytes = Files.readAllBytes(Paths.get(secretFile));
Map<String,String> content = codec.fromBytes(bytes);
if (content.get("app-secret") == null || content.get("app-secret").isBlank()) {
    throw new IllegalStateException("Secret file missing non-blank 'app-secret' key");
}

try { connector.start(); } catch (IllegalArgumentException e) { if (e.getMessage().startsWith("app-secret not provided")) { // repopulate the 'app-secret' key and restart } else { throw e; } }

When it happens

Trigger: Secret file decodes to a map with no 'app-secret' entry, or the entry is an empty/whitespace-only string, when loadAppSecret extracts content.get("app-secret").

Common situations: Hand-edited secret file missing the key; key renamed (e.g. 'appSecret' vs 'app-secret'); file regenerated with only the app-id; empty value left after rotating secrets.

Related errors

• Could not read secret file " + secretFile
• Required configuration 'flight-shim.server' and 'flight-shim
• Unknown property at line %s:%s: %s
• Original function call and substitute must both be specified
• NOT_SUPPORTED

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/dacd06724059a91f. Report an issue: GitHub.