quarkusio/quarkus · error · ConfigurationException

'%scredentials.jwt.token-path' can only be set when the JWT

Error message

'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'

What it means

credentials.jwt.token-path is only meaningful when the JWT comes from an external source ('bearer' or 'spiffe-jwt'). If source is 'client' (the default, meaning Quarkus signs the JWT itself) and a token-path is still set, verifyCommonConfiguration throws at startup to flag the dangling, ignored property.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:261

        Credentials.Jwt jwt = creds.jwt();
        if (jwt.source() == Source.BEARER) {
            if (isServerConfig && jwt.tokenPath().isEmpty()) {
                throw new ConfigurationException(
                        String.format("'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'",
                                configPrefix));
            }
        } else if (jwt.source() == Source.SPIFFE_JWT) {
            if (jwt.tokenPath().isEmpty() && Arc.container().select(SpiffeClient.class).isUnsatisfied()) {
                throw new ConfigurationException(String.format(
                        "'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available."
                                + " Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID,"
                                + " or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs"
                                + " from the SPIFFE Workload API",
                        configPrefix));
            }
        } else if (jwt.source() == Source.CLIENT && jwt.tokenPath().isPresent()) {
            throw new ConfigurationException(String.format(
                    "'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'",
                    configPrefix));
        }
    }

    public static String prependSlash(String path) {
        return !path.startsWith("/") ? "/" + path : path;
    }

    public static Buffer encodeForm(MultiMap form) {
        return encodeForm(form, Buffer.buffer());
    }

    public static Buffer encodeForm(MultiMap form, Buffer buffer) {
        for (Map.Entry<String, String> entry : form) {
            if (buffer.length() != 0) {
                buffer.appendByte(AMP);
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the credentials.jwt.token-path property if the client signs its own JWT
2. Or set credentials.jwt.source=bearer (or spiffe-jwt) if the token really comes from a file
3. Review the credentials.jwt block and keep only properties consistent with the chosen source

Example fix

# before
quarkus.oidc-client.credentials.jwt.source=client
quarkus.oidc-client.credentials.jwt.token-path=/var/run/token

# after
quarkus.oidc-client.credentials.jwt.source=client

String source = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.source", String.class).orElse("client");
boolean tokenPath = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.token-path", String.class).isPresent();
if ("client".equals(source) && tokenPath)
    throw new IllegalStateException("token-path is only valid for source=bearer or spiffe-jwt");

try {
    start();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("can only be set when the JWT source")) log.error("Remove token-path or set jwt.source=bearer/spiffe-jwt");
    throw e;
}

When it happens

Trigger: credentials.jwt.token-path is set while credentials.jwt.source is unset or set to 'client' under the same config prefix.

Common situations: Copying a bearer-source config and removing the source line but keeping token-path; leftover token-path after switching from SPIFFE to signed client assertions; typo like source=client explicit with token-path.

Related errors

• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu
• Access token is required to check the roles but DefaultToken
• UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2c315cf952a0d6f3. Report an issue: GitHub.