quarkusio/quarkus · error · ConfigurationException

Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.

Error message

Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.key-file' or '%1$scredentials.jwt.key-store-file' can be configured

What it means

Quarkus OIDC client credentials allow signing a client JWT with either a raw secret, a PEM private key file, or a keystore file — but only one at a time. During startup, verifyCommonConfiguration counts how many of credentials.jwt.key, credentials.jwt.key-file and credentials.jwt.key-store-file are set; if more than one is present, startup aborts with this ConfigurationException so the ambiguity is caught before any token request is made.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:198

        }
        boolean clientSecretConfigured = creds.secret().isPresent()
                || creds.clientSecret().value().isPresent()
                || creds.clientSecret().provider().key().isPresent();
        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()
                || creds.jwt().secretProvider().key().isPresent();

        if (clientSecretConfigured && jwtSecretConfigured) {
            throw new ConfigurationException(
                    String.format(
                            "Only one of client secret or JWT secret authentication methods can be configured,"
                                    + " but '%1$scredentials' has both a client secret and a JWT secret property set",
                            configPrefix));
        }
        int jwtKeyPropsCount = (creds.jwt().key().isPresent() ? 1 : 0)
                + (creds.jwt().keyFile().isPresent() ? 1 : 0)
                + (creds.jwt().keyStoreFile().isPresent() ? 1 : 0);
        if (jwtKeyPropsCount > 1) {
            throw new ConfigurationException(
                    String.format(
                            "Only one of '%1$scredentials.jwt.key', '%1$scredentials.jwt.key-file'"
                                    + " or '%1$scredentials.jwt.key-store-file' can be configured",
                            configPrefix));
        }
        boolean jwtKeyConfigured = jwtKeyPropsCount == 1;
        boolean jwtBearerOrSpiffe = creds.jwt().source() == Source.BEARER
                || creds.jwt().source() == Source.SPIFFE_JWT;

        if (jwtSecretConfigured && jwtKeyConfigured) {
            throw new ConfigurationException(
                    String.format(
                            "Only one of JWT secret or JWT private key authentication methods can be configured,"
                                    + " but '%1$scredentials.jwt' has both a JWT secret and a JWT key property set",
                            configPrefix));
        }
        if (clientSecretConfigured && jwtKeyConfigured) {
            throw new ConfigurationException(

View on GitHub (pinned to e1c734241f)

Solutions

Remove the properties you do not want, keeping exactly one of credentials.jwt.key, credentials.jwt.key-file, credentials.jwt.key-store-file
Run ./quarkus dev or mvn quarkus:dev to confirm the app starts and check which effective properties are set (quarkus.config ExpandConfigSource)
If you need multiple deployment variants, use Maven/Quarkus profiles to enable only one property per profile instead of setting all at once

Example fix

# before
quarkus.oidc-client.credentials.jwt.key=abc123
quarkus.oidc-client.credentials.jwt.key-file=/etc/certs/key.pem

# after
quarkus.oidc-client.credentials.jwt.key-file=/etc/certs/key.pem

Defensive patterns

Strategy: validation

Validate before calling

long count = Stream.of(
        ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.key", String.class),
        ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.key-file", String.class),
        ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.key-store-file", String.class))
    .filter(Optional::isPresent).count();
if (count > 1) throw new IllegalStateException("Configure at most one jwt key property");

Try / catch

try {
    runApp();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("jwt.key")) {
        log.error("Fix OIDC credentials: keep only one of jwt.key/key-file/key-store-file");
    }
    throw e;
}

Prevention

Keep only one jwt key property per config prefix; delete others when changing auth style
Use profiles to vary credentials per environment instead of setting several properties
Grep application.properties for 'credentials.jwt.key' in CI to detect duplicates early

When it happens

Trigger: Setting two or more of quarkus.oidc-client.credentials.jwt.key, quarkus.oidc-client.credentials.jwt.key-file and quarkus.oidc-client.credentials.jwt.key-store-file (with the config prefix matching the named OIDC provider, e.g. quarkus.oidc.<name>.credentials.jwt.*) in application.properties at startup.

Common situations: Left-over key-file property when switching to an inline key; copy-pasting config from two examples; environment-variable override adding a keystore on top of an existing key-file; team migration from PEM to keystore without deleting the old property.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b35c491d3e0f6c56. Report an issue: GitHub.