quarkusio/quarkus · error · ConfigurationException

'%1$scredentials.secret' and '%1$scredentials.client-secret'

Error message

'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive

What it means

verifyCommonConfiguration rejects configurations that set both the legacy credentials.secret and the credentials.client-secret properties, since they are two mutually exclusive ways of specifying the same client secret. When both are present, a ConfigurationException names both properties and the config prefix (quarkus.oidc. or quarkus.oidc-client.).

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:176

            // Verify that endpoint url is a valid URL
            URI.create(endpointUrl).toURL();
        } catch (Throwable ex) {
            throw new ConfigurationException(
                    String.format("'%s' is invalid", endpointUrl), ex);
        }
    }

    public static void verifyCommonConfiguration(OidcClientCommonConfig oidcConfig, boolean clientIdOptional,
            boolean isServerConfig) {
        final String configPrefix = isServerConfig ? "quarkus.oidc." : "quarkus.oidc-client.";
        if (!clientIdOptional && !oidcConfig.clientId().isPresent()) {
            throw new ConfigurationException(
                    String.format("'%sclient-id' property must be configured", configPrefix));
        }

        Credentials creds = oidcConfig.credentials();
        if (creds.secret().isPresent() && creds.clientSecret().value().isPresent()) {
            throw new ConfigurationException(
                    String.format(
                            "'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive",
                            configPrefix));
        }
        boolean clientSecretConfigured = creds.secret().isPresent()
                || creds.clientSecret().value().isPresent()
                || creds.clientSecret().provider().key().isPresent();
        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()
                || creds.jwt().secretProvider().key().isPresent();

        if (clientSecretConfigured && jwtSecretConfigured) {
            throw new ConfigurationException(
                    String.format(
                            "Only one of client secret or JWT secret authentication methods can be configured,"
                                    + " but '%1$scredentials' has both a client secret and a JWT secret property set",
                            configPrefix));
        }
        int jwtKeyPropsCount = (creds.jwt().key().isPresent() ? 1 : 0)

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove credentials.secret and keep credentials.client-secret (recommended, supports secrets provider)
2. Or remove credentials.client-secret and keep only credentials.secret
3. Audit environment variables and profile-specific files so only one variant is defined

Example fix

// before
quarkus.oidc.credentials.secret=topsecret
quarkus.oidc.credentials.client-secret.value=topsecret
// after
quarkus.oidc.credentials.client-secret.value=topsecret

// pass only one of the two
if (cfg.optional("quarkus.oidc.credentials.secret").isPresent()
        && cfg.optional("quarkus.oidc.credentials.client-secret.value").isPresent()) {
    throw new IllegalArgumentException("credentials.secret and credentials.client-secret are mutually exclusive");
}

try {
    startApplication();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("mutually exclusive")) {
        LOG.error("Keep only credentials.secret OR credentials.client-secret");
    }
}

When it happens

Trigger: Startup with both quarkus.oidc.credentials.secret and quarkus.oidc.credentials.client-secret (or the quarkus.oidc-client. equivalents) set simultaneously.

Common situations: Migration from old config naming to the newer client-secret block where the old property was not removed; merged config files from different sources (env var + properties file) each supplying one variant.

Related errors

• Only one of client secret or JWT secret authentication metho
• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to find a matching OidcTenantConfig for tenant:
• Truststore with configured password which keeps thumbprints

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/07d88558f46fc6ac. Report an issue: GitHub.