quarkusio/quarkus · error · IllegalStateException

Could not retrieve ${missingKeys} from credentials provider

Error message

Could not retrieve ${missingKeys} from credentials provider ${providerName}

What it means

Thrown at build time by ProxyConfigurationRecorder when a proxy configuration references a credentials provider but the provider could not return the requested username and/or password keys. Quarkus collects whichever keys were missing and fails the build with the list so the misconfigured credential lookup is obvious.

Source

Thrown at extensions/proxy-registry/runtime/src/main/java/io/quarkus/proxy/runtime/ProxyConfigurationRecorder.java:113

            username = config.username();
            password = config.password();
        } else {
            ProxyConfig.ProxyCredentialProviderConfig providerConfig = config.credentialsProvider();
            if (providerConfig.name().isPresent()) {
                CredentialsProvider provider = CredentialsProviderFinder.find(providerConfig.beanName().orElse(null));
                Map<String, String> credentials = provider.getCredentialsAsync(providerConfig.name().get())
                        .await().indefinitely();
                username = Optional.ofNullable(credentials.get(providerConfig.usernameKey()));
                password = Optional.ofNullable(credentials.get(providerConfig.passwordKey()));
                if (username.isEmpty() || password.isEmpty()) {
                    StringJoiner missingKeys = new StringJoiner(" and ");
                    if (username.isEmpty()) {
                        missingKeys.add(providerConfig.usernameKey());
                    }
                    if (password.isEmpty()) {
                        missingKeys.add(providerConfig.passwordKey());
                    }
                    throw new IllegalStateException("Could not retrieve " + missingKeys + " from credentials provider "
                            + providerConfig.name().get());
                }
            } else {
                username = Optional.empty();
                password = Optional.empty();
            }
        }

        return Optional.of(new ProxyConfigurationImpl(
                config.host().get(),
                config.port().getAsInt(),
                username,
                password,
                config.nonProxyHosts(),
                config.proxyConnectTimeout(),
                config.type()));
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure the credentials provider actually contains entries for the configured username-key and password-key at build time (check the backing store: file, vault, Kubernetes secret, etc.).
2. Verify quarkus.proxy."<name>".credentials-provider.name matches a registered CredentialsProvider bean and its name() value.
3. Check the username-key/password-key values for typos or wrong case.
4. If credentials are only available at runtime, provide quarkus.proxy."<name>".username and .password directly via runtime config instead of a build-time credentials provider.
5. Add logging/debug output in your custom CredentialsProvider to see which keys are being requested.

Example fix

// before (application.properties)
quarkus.proxy."corp".host=proxy.corp.example
quarkus.proxy."corp".port=8080
quarkus.proxy."corp".credentials-provider=vault-cred
quarkus.proxy."corp".credentials-provider.username-key=proxy-user-key

// after (keys match what the provider stores)
quarkus.proxy."corp".credentials-provider.username-key=corp-proxy/user
quarkus.proxy."corp".credentials-provider.password-key=corp-proxy/password

// Verify the provider can serve the keys before relying on them at build time
CredentialsProvider provider = ...; // your registered provider
Map<String,String> creds = provider.credentials("vault-cred", "corp-proxy");
if (!creds.containsKey("corp-proxy/user") || !creds.containsKey("corp-proxy/password")) {
    throw new IllegalStateException(
        "Credentials provider vault-cred is missing corp-proxy/user and/or corp-proxy/password");
}

When it happens

Trigger: quarkus.proxy."<name>".credentials-provider is set (and username/password are not directly set), the named io.quarkus.credentials.CredentialsProvider exists, but credentialsProvider.credentials(name, key) returned empty for the usernameKey and/or passwordKey configured via quarkus.proxy."<name>".credentials-provider.username-key / .password-key.

Common situations: The vault/secrets backend (e.g. filesystem, Kubernetes secret mounted later, consul) has no entry for the key at build time; a custom CredentialsProvider returns an empty map; custom username-key/password-key names do not match what the provider stores; the credentials provider is only available at runtime while proxy config is resolved during static init.

Related errors

• ${prefix}.username and ${prefix}.password must be both set o
• The configuration ${clazz} is missing the @ConfigRoot annota
• Invalid configuration value set for 'quarkus.arc.remove-unus
• Hibernate Envers activated explicitly for persistence unit '
• The FastbootHibernateProvider PersistenceProvider can not su

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4f5dd6d675819a7e. Report an issue: GitHub.