quarkusio/quarkus · error · ConfigurationException

'%sclient-id' property must be configured

Error message

'%sclient-id' property must be configured

What it means

verifyCommonConfiguration enforces that a client_id is configured whenever it is not optional. For OIDC web-app/service apps (prefix quarkus.oidc.) or OIDC clients (prefix quarkus.oidc-client.), a missing quarkus.<prefix>client-id property causes a ConfigurationException at startup. This is a fail-fast validation because most OIDC flows require identifying the client.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:170

        }
        return maskedJson;
    }

    public static void verifyEndpointUrl(String endpointUrl) {
        try {
            // Verify that endpoint url is a valid URL
            URI.create(endpointUrl).toURL();
        } catch (Throwable ex) {
            throw new ConfigurationException(
                    String.format("'%s' is invalid", endpointUrl), ex);
        }
    }

    public static void verifyCommonConfiguration(OidcClientCommonConfig oidcConfig, boolean clientIdOptional,
            boolean isServerConfig) {
        final String configPrefix = isServerConfig ? "quarkus.oidc." : "quarkus.oidc-client.";
        if (!clientIdOptional && !oidcConfig.clientId().isPresent()) {
            throw new ConfigurationException(
                    String.format("'%sclient-id' property must be configured", configPrefix));
        }

        Credentials creds = oidcConfig.credentials();
        if (creds.secret().isPresent() && creds.clientSecret().value().isPresent()) {
            throw new ConfigurationException(
                    String.format(
                            "'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive",
                            configPrefix));
        }
        boolean clientSecretConfigured = creds.secret().isPresent()
                || creds.clientSecret().value().isPresent()
                || creds.clientSecret().provider().key().isPresent();
        boolean jwtSecretConfigured = creds.jwt().secret().isPresent()
                || creds.jwt().secretProvider().key().isPresent();

        if (clientSecretConfigured && jwtSecretConfigured) {
            throw new ConfigurationException(

View on GitHub (pinned to e1c734241f)

Solutions

1. Add quarkus.oidc.client-id (or quarkus.oidc-client.client-id) to your configuration
2. If the client truly does not need an id (e.g. certain public clients), use the configuration path where clientIdOptional is honored
3. Check that the property is not excluded by an active config profile or build-time omission

Example fix

// before
quarkus.oidc.auth-server-url=https://idp.example.com/realms/main
// after
quarkus.oidc.auth-server-url=https://idp.example.com/realms/main
quarkus.oidc.client-id=my-app

if (!ConfigProvider.getConfig().getOptionalValue("quarkus.oidc.client-id", String.class).isPresent()) {
    throw new IllegalArgumentException("quarkus.oidc.client-id must be configured");
}

try {
    startApplication();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("client-id")) {
        LOG.error("Set quarkus.oidc.client-id (or quarkus.oidc-client.client-id)");
    }
}

When it happens

Trigger: Startup validation when oidcConfig.clientId() is empty and clientIdOptional=false — e.g. quarkus.oidc-client.* without quarkus.oidc-client.client-id set, or quarkus.oidc.* without quarkus.oidc.client-id where required.

Common situations: Freshly scaffolded apps where the client-id was never added; switching from anonymous/public access to confidential client flows; config profile (prod) that omits client-id.

Related errors

• '%s' property must be configured
• Could not obtain principal
• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to find a matching OidcTenantConfig for tenant:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f02f492996483d7c. Report an issue: GitHub.