quarkusio/quarkus · error · IllegalStateException

Could not retrieve from credentials provider

Error message

Could not retrieve ${missingKeys} from credentials provider ${providerName}

What it means

Thrown at build time by ProxyConfigurationRecorder when a proxy configuration references a credentials provider but the provider could not return the requested username and/or password keys. Quarkus collects whichever keys were missing and fails the build with the list so the misconfigured credential lookup is obvious.

Solutions

1. Ensure the credentials provider actually contains entries for the configured username-key and password-key at build time (check the backing store: file, vault, Kubernetes secret, etc.).
2. Verify quarkus.proxy."<name>".credentials-provider.name matches a registered CredentialsProvider bean and its name() value.
3. Check the username-key/password-key values for typos or wrong case.
4. If credentials are only available at runtime, provide quarkus.proxy."<name>".username and .password directly via runtime config instead of a build-time credentials provider.
5. Add logging/debug output in your custom CredentialsProvider to see which keys are being requested.

Example fix

// before (application.properties)
quarkus.proxy."corp".host=proxy.corp.example
quarkus.proxy."corp".port=8080
quarkus.proxy."corp".credentials-provider=vault-cred
quarkus.proxy."corp".credentials-provider.username-key=proxy-user-key

// after (keys match what the provider stores)
quarkus.proxy."corp".credentials-provider.username-key=corp-proxy/user
quarkus.proxy."corp".credentials-provider.password-key=corp-proxy/password

// Verify the provider can serve the keys before relying on them at build time
CredentialsProvider provider = ...; // your registered provider
Map<String,String> creds = provider.credentials("vault-cred", "corp-proxy");
if (!creds.containsKey("corp-proxy/user") || !creds.containsKey("corp-proxy/password")) {
    throw new IllegalStateException(
        "Credentials provider vault-cred is missing corp-proxy/user and/or corp-proxy/password");
}

When it happens

Trigger: quarkus.proxy."<name>".credentials-provider is set (and username/password are not directly set), the named io.quarkus.credentials.CredentialsProvider exists, but credentialsProvider.credentials(name, key) returned empty for the usernameKey and/or passwordKey configured via quarkus.proxy."<name>".credentials-provider.username-key / .password-key.

Common situations: The vault/secrets backend (e.g. filesystem, Kubernetes secret mounted later, consul) has no entry for the key at build time; a custom CredentialsProvider returns an empty map; custom username-key/password-key names do not match what the provider stores; the credentials provider is only available at runtime while proxy config is resolved during static init.

Related errors

• .username and .password must be both set or both unset
• Cannot find the Proxy registry configuration
• Clustered jobs configured with unsupported job store option
• Configuration property…
• Hibernate Envers activated explicitly for persistence unit

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4f5dd6d675819a7e. Report an issue: GitHub.

Appendix: source

Thrown at extensions/proxy-registry/runtime/src/main/java/io/quarkus/proxy/runtime/ProxyConfigurationRecorder.java:113

            username = config.username();
            password = config.password();
        } else {
            ProxyConfig.ProxyCredentialProviderConfig providerConfig = config.credentialsProvider();
            if (providerConfig.name().isPresent()) {
                CredentialsProvider provider = CredentialsProviderFinder.find(providerConfig.beanName().orElse(null));
                Map<String, String> credentials = provider.getCredentialsAsync(providerConfig.name().get())
                        .await().indefinitely();
                username = Optional.ofNullable(credentials.get(providerConfig.usernameKey()));
                password = Optional.ofNullable(credentials.get(providerConfig.passwordKey()));
                if (username.isEmpty() || password.isEmpty()) {
                    StringJoiner missingKeys = new StringJoiner(" and ");
                    if (username.isEmpty()) {
                        missingKeys.add(providerConfig.usernameKey());
                    }
                    if (password.isEmpty()) {
                        missingKeys.add(providerConfig.passwordKey());
                    }
                    throw new IllegalStateException("Could not retrieve " + missingKeys + " from credentials provider "
                            + providerConfig.name().get());
                }
            } else {
                username = Optional.empty();
                password = Optional.empty();
            }
        }

        return Optional.of(new ProxyConfigurationImpl(
                config.host().get(),
                config.port().getAsInt(),
                username,
                password,
                config.nonProxyHosts(),
                config.proxyConnectTimeout(),
                config.type()));
    }
}

View on GitHub (pinned to e1c734241f)