Cannot call 'requireOutputValue' if the referenced stack out

Error message

Cannot call 'requireOutputValue' if the referenced stack output is a secret. Use 'requireOutput' instead.

What it means

requireOutputValue requires that the named output exists AND is not secret, returning its raw value. Secrets cannot be returned as plain values, so when the referenced output is secret the SDK throws and points to requireOutput, which returns a secret-aware Output instead.

Source

Thrown at sdk/nodejs/stackReference.ts:170

            );
        }
        return out;
    }

    /**
     * Fetches the value promptly of the named stack output. Throws an error if
     * the stack output is not found.
     *
     * This operation is not supported (and will throw) if the named stack
     * output is a secret.
     *
     * @param name
     *  The name of the stack output to fetch.
     */
    public async requireOutputValue(name: string): Promise<any> {
        const [out, isSecret] = await this.readOutputValue("requireOutputSync", name, true /*required*/);
        if (isSecret) {
            throw new Error(
                "Cannot call 'requireOutputValue' if the referenced stack output is a secret. Use 'requireOutput' instead.",
            );
        }
        return out;
    }

    private async readOutputValue(callerName: string, outputName: string, required: boolean): Promise<[any, boolean]> {
        const out = required ? this.requireOutput(outputName) : this.getOutput(outputName);
        return Promise.all([out.promise(), out.isSecret]);
    }
}

/**
 * The set of arguments for constructing a {@link StackReference} resource.
 */
export interface StackReferenceArgs {
    /**
     * The name of the stack to reference.

View on GitHub (pinned to 793f7b2e16)

Solutions

Replace requireOutputValue with requireOutput(name), keeping the secret wrapped in an Output.
Pass the resulting secret Output directly to resource properties instead of unwrapping it.
If the value must not be secret, change the upstream export and redeploy that stack.

Example fix

// before
const key = await stackRef.requireOutputValue("apiKey");
// after
const key = stackRef.requireOutput("apiKey"); // secret Output, pass to resources

Defensive patterns

Strategy: fallback

Validate before calling

// Use the secret-aware API unconditionally:
const key = stackRef.requireOutput("apiKey"); // throws only if missing, keeps secret wrapping

Try / catch

try {
  const raw = await stackRef.requireOutputValue("apiKey");
} catch (err) {
  if ((err as Error).message.includes("is a secret")) {
    const key = stackRef.requireOutput("apiKey");
  } else {
    throw err;
  }
}

Prevention

Use requireOutput/getOutput unless you are certain the output is plaintext.
Assume credential-like outputs are secret and pass them as secret Outputs.
When upstream marks an output secret, update all downstream consumers at once.

When it happens

Trigger: Calling stackRef.requireOutputValue(name) where the output exists in the referenced stack but was exported via pulumi.secret(...) or otherwise marked secret.

Common situations: Downstream code written before upstream hardened the output as a secret; cross-stack DB credentials/API keys; automation expecting plaintext stack outputs from the engine.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/24dbad6843d2a085. Report an issue: GitHub.