quarkusio/quarkus · error · ConfigurationException

Client credentials cannot be sent to all OIDC endpoints beca

Error message

Client credentials cannot be sent to all OIDC endpoints because only 'client_secret_basic' or JWT bearer ('jwt.source=bearer') authentication methods are supported

What it means

When OIDC client credentials must be sent to all OIDC endpoints, only two methods are supported: HTTP Basic with the client secret (client_secret_basic) or a JWT bearer client assertion (jwt.source=bearer). Any other credential arrangement (e.g. client_secret_post, or a non-bearer JWT) is rejected at startup.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:462

        return (creds.clientSecret().value().isPresent() || creds.clientSecret().provider().key().isPresent())
                && clientSecretMethod(creds) == Secret.Method.POST;
    }

    public static boolean isClientSecretPostJwtAuthRequired(Credentials creds) {
        return clientSecretMethod(creds) == Secret.Method.POST_JWT;
    }

    public static void validateCredentialsForAllEndpoints(Credentials creds) {
        if (!creds.forAllEndpoints()) {
            return;
        }
        if (isClientSecretBasicAuthRequired(creds)) {
            return;
        }
        if (creds.jwt().source() == Source.BEARER && creds.jwt().tokenPath().isPresent()) {
            return;
        }
        throw new ConfigurationException(
                "Client credentials cannot be sent to all OIDC endpoints because only "
                        + "'client_secret_basic' or JWT bearer ('jwt.source=bearer') authentication methods are supported");
    }

    public static boolean isJwtAssertion(Credentials creds) {
        return creds.jwt().assertion();
    }

    public static Uni<String> clientSecret(Credentials creds) {
        if (creds.secret().isPresent()) {
            return Uni.createFrom().item(creds.secret().get());
        }
        if (creds.clientSecret().value().isPresent()) {
            return Uni.createFrom().item(creds.clientSecret().value().get());
        }
        return fromCredentialsProvider(creds.clientSecret().provider());
    }

View on GitHub (pinned to e1c734241f)

Solutions

Switch the client secret method to basic: quarkus.oidc.credentials.client-secret.method=basic (or just supply the secret, which defaults to basic)
Use a JWT bearer assertion: set quarkus.oidc.credentials.jwt.source=bearer and quarkus.oidc.credentials.jwt.token-path
Check whether credentials are actually required for all endpoints; if not, adjust so credentials only apply where supported
Consult provider docs — if only client_secret_post is supported, verify the endpoint subset the method applies to avoids this check

Example fix

// before
quarkus.oidc.credentials.client-secret.value=secret
quarkus.oidc.credentials.client-secret.method=post
// after
quarkus.oidc.credentials.client-secret.value=secret
quarkus.oidc.credentials.client-secret.method=basic

Defensive patterns

Strategy: validation

Validate before calling

String method = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc.credentials.client-secret.method", String.class).orElse("basic");
String jwtSource = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc.credentials.jwt.source", String.class).orElse("");
boolean ok = "basic".equals(method) || "bearer".equals(jwtSource);
if (!ok) throw new IllegalStateException("Use client_secret_basic or jwt.source=bearer for all-endpoint credentials");

Try / catch

try { startApp(); } catch (ConfigurationException e) { if (e.getMessage().contains("client_secret_basic")) log.error("Switch client auth method to basic or jwt.source=bearer"); throw e; }

Prevention

Prefer the default basic method for client secrets
Only use client_secret_post when the token endpoint alone requires it and credentials are scoped accordingly
Review provider docs on which auth methods apply to token/introspection/revocation endpoints

When it happens

Trigger: Credentials configured so that isClientSecretBasicAuthRequired is false and credentials are not jwt.source=bearer with a tokenPath — e.g. quarkus.oidc.credentials.client-secret.method=post, or a JWT used as a signed (assertion) token while the client still needs credentials on token/revocation/introspection endpoints.

Common situations: Configuring client_secret_post because the OIDC provider recommends it for token requests while other endpoints also need credentials; copying a client-assertion config from a provider that only supports bearer JWT for its token endpoint.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/94c28f8217181b4c. Report an issue: GitHub.