quarkusio/quarkus · error · OidcClientException

Access token is null

Error message

Access token is null

What it means

OidcClientImpl.revokeAccessToken() sends the access token as the revocation token parameter; a null token cannot be revoked, so the method fails fast with an OidcClientException before issuing the revocation request.

Source

Thrown at extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java:129

        return getJsonResponse(OidcEndpoint.Type.TOKEN, tokenGrantParams, additionalGrantParameters, Operation.GET);
    }

    @Override
    public Uni<Tokens> refreshTokens(String refreshToken, Map<String, String> additionalGrantParameters) {
        checkClosed();
        if (refreshToken == null) {
            throw new OidcClientException("Refresh token is null");
        }
        MultiMap refreshGrantParams = copyMultiMap(commonRefreshGrantParams);
        refreshGrantParams.add(OidcConstants.REFRESH_TOKEN_VALUE, refreshToken);
        return getJsonResponse(OidcEndpoint.Type.TOKEN, refreshGrantParams, additionalGrantParameters, Operation.REFRESH);
    }

    @Override
    public Uni<Boolean> revokeAccessToken(String accessToken, Map<String, String> additionalParameters) {
        checkClosed();
        if (accessToken == null) {
            throw new OidcClientException("Access token is null");
        }
        OidcRequestContextProperties requestProps = getRequestProps(null);

        if (tokenRevokeUri != null) {
            MultiMap tokenRevokeParams = MultiMap.caseInsensitiveMultiMap();
            tokenRevokeParams.set(OidcConstants.REVOCATION_TOKEN, accessToken);
            return withAsyncCredentials().flatMap(asyncCredentials -> postRequest(requestProps,
                    OidcEndpoint.Type.TOKEN_REVOCATION,
                    client.postAbs(tokenRevokeUri), tokenRevokeParams, additionalParameters, Operation.REVOKE, asyncCredentials)
                    .flatMap(resp -> toRevokeResponse(requestProps, resp)));
        } else {
            LOG.debugf("%s OidcClient can not revoke the access token because the revocation endpoint URL is not set");
            return Uni.createFrom().item(false);
        }

    }

    private OidcRequestContextProperties getRequestProps(String grantType) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Check the access token for null/blank before calling revokeAccessToken() and skip revocation if absent.
2. Pass the correct token field from your Tokens/store object.
3. If revocation of a null token should be a no-op, wrap the call in a null check instead of letting it throw.

Example fix

// before
oidcClient.revokeAccessToken(tokens.getAccessToken(), Map.of());

// after
if (tokens.getAccessToken() != null) {
    oidcClient.revokeAccessToken(tokens.getAccessToken(), Map.of());
}

String at = tokens.getAccessToken();
if (at == null || at.isBlank()) {
    return; // nothing to revoke
}

boolean hasAccessToken(Tokens t) { return t != null && t.getAccessToken() != null && !t.getAccessToken().isBlank(); }

try {
    return client.revokeAccessToken(at, params);
} catch (OidcClientException e) {
    if (e.getMessage().contains("Access token is null")) {
        return Uni.createFrom().item(false);
    }
    throw e;
}

When it happens

Trigger: Calling oidcClient.revokeAccessToken(null, additionalParameters) — commonly when the Tokens object being revoked has a null access token or a variable was never populated.

Common situations: Revoking tokens on logout where the access token was never obtained (e.g. only an ID token exists); passing the wrong field (refresh token absent / access token null) from a custom token store.

Related errors

• Refresh token is null
• Extension name cannot be null
• Cannot add header, key and value must not be null
• Cannot remove header, key must not be null
• Contextual parameter must not be null

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e2e1d67f220273ae. Report an issue: GitHub.