quarkusio/quarkus · error · ConfigurationException

'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no

Error message

'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available. Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API

What it means

With credentials.jwt.source=spiffe-jwt, the JWT-SVID can come either from a token-path file or from the SPIFFE Workload API via the quarkus-spiffe-client extension. verifyCommonConfiguration checks at runtime (Arc.container().select(SpiffeClient.class).isUnsatisfied()) that at least one provider exists; if token-path is empty and no SpiffeClient bean is available, startup fails.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:253

        }
        if (jwtSecretConfigured && jwtBearerOrSpiffe) {
            throw new ConfigurationException(
                    String.format(
                            "Only one of JWT secret or JWT bearer/SPIFFE authentication methods can be configured,"
                                    + " but '%1$scredentials' has both a JWT secret and '%1$scredentials.jwt.source=%2$s' set",
                            configPrefix, creds.jwt().source().toString().toLowerCase()));
        }

        Credentials.Jwt jwt = creds.jwt();
        if (jwt.source() == Source.BEARER) {
            if (isServerConfig && jwt.tokenPath().isEmpty()) {
                throw new ConfigurationException(
                        String.format("'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'",
                                configPrefix));
            }
        } else if (jwt.source() == Source.SPIFFE_JWT) {
            if (jwt.tokenPath().isEmpty() && Arc.container().select(SpiffeClient.class).isUnsatisfied()) {
                throw new ConfigurationException(String.format(
                        "'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available."
                                + " Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID,"
                                + " or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs"
                                + " from the SPIFFE Workload API",
                        configPrefix));
            }
        } else if (jwt.source() == Source.CLIENT && jwt.tokenPath().isPresent()) {
            throw new ConfigurationException(String.format(
                    "'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'",
                    configPrefix));
        }
    }

    public static String prependSlash(String path) {
        return !path.startsWith("/") ? "/" + path : path;
    }

    public static Buffer encodeForm(MultiMap form) {

View on GitHub (pinned to e1c734241f)

Solutions

Add the quarkus-spiffe-client extension dependency so Quarkus can fetch JWT-SVIDs from the SPIFFE Workload API, e.g. quarkus ext add quarkus-spiffe-client
Or set quarkus.oidc[-client].credentials.jwt.token-path to a file containing the JWT-SVID
Verify the property prefix is correct and the spiffe-jwt source is intended for this provider

Example fix

# before (pom.xml has no spiffe client, no token-path)
quarkus.oidc.credentials.jwt.source=spiffe-jwt

# after
quarkus.oidc.credentials.jwt.source=spiffe-jwt
quarkus.oidc.credentials.jwt.token-path=/run/secrets/spiffe/jwt-svid

Defensive patterns

Strategy: fallback

Validate before calling

String source = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc.credentials.jwt.source", String.class).orElse(null);
String tokenPath = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc.credentials.jwt.token-path", String.class).orElse(null);
if ("spiffe-jwt".equals(source) && (tokenPath == null || tokenPath.isBlank()))
    log.warn("spiffe-jwt source with no token-path: ensure quarkus-spiffe-client extension is on the classpath");

Try / catch

try {
    start();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("SPIFFE")) log.error("Add quarkus-spiffe-client or set jwt.token-path to a JWT-SVID file");
    throw e;
}

Prevention

Add quarkus-spiffe-client whenever using jwt.source=spiffe-jwt without a token-path
Verify the workload runtime actually provides the SPIFFE Workload API socket
Document the two supported SVID sources (file vs Workload API) for the team

When it happens

Trigger: credentials.jwt.source=spiffe-jwt with empty credentials.jwt.token-path AND no SpiffeClient bean in the CDI container (quarkus-spiffe-client extension not added / bean unsatisfied).

Common situations: Running in a SPIFFE-enabled cluster but forgetting to add the quarkus-spiffe-client dependency; expecting SPIFFE to be auto-detected without configuring token-path; wrong property name so token-path resolves empty.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7f88a31e012727e1. Report an issue: GitHub.