quarkusio/quarkus · error · RuntimeException

Unable to find the default credentials provider

Error message

Unable to find the default credentials provider

What it means

CredentialProviders.lookup resolves a CDI CredentialsProvider bean by name (or the default when name is null) from the ArC container. When no such bean is registered, it throws this RuntimeException, meaning a keystore/truststore password was configured to come from a credentials provider that does not exist.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/CredentialProviders.java:67

            CredentialsProvider provider = lookup(config.beanName().orElse(null));
            Map<String, String> credentials = provider.getCredentialsAsync(config.name().get()).await().indefinitely();
            return Optional.ofNullable(credentials.get(config.passwordKey()));
        }
        return Optional.empty();
    }

    static CredentialsProvider lookup(String name) {
        ArcContainer container = Arc.container();
        InstanceHandle<CredentialsProvider> instance;
        if (name == null) {
            instance = container.instance(CredentialsProvider.class);
        } else {
            instance = container.instance(CredentialsProvider.class, NamedLiteral.of(name));
        }

        if (!instance.isAvailable()) {
            if (name == null) {
                throw new RuntimeException("Unable to find the default credentials provider");
            } else {
                throw new RuntimeException("Unable to find the credentials provider named '" + name + "'");
            }
        }

        return instance.get();
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Add the quarkus-credentials extension (or a custom class implementing io.quarkus.credentials.CredentialsProvider marked as @ApplicationScoped/@Singleton)
2. If a named provider was intended, set the provider name explicitly in config
3. Verify the provider bean is in a package scanned by Quarkus
4. Check that the dependency containing the provider is on the runtime classpath

Example fix

// before: no provider registered, config uses default
// after
@ApplicationScoped
public class MyCredentialsProvider implements CredentialsProvider {
    @Override
    public Map<String, String> getCredentials(String credentialsProviderName) {
        return Map.of(CredentialsProvider.PASSWORD_PROPERTY_NAME, "secret");
    }
}

// Verify a CredentialsProvider bean is discoverable before startup relies on it
Optional<CredentialsProvider> p = Arc.container()
    .instance(CredentialsProvider.class).handle();
if (p.isEmpty()) {
    throw new IllegalStateException("Add quarkus-credentials or register a CredentialsProvider bean");
}

try {
    Quarkus.run(args);
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().contains("default credentials provider")) {
        log.error("No CredentialsProvider bean registered; add quarkus-credentials extension");
    }
    throw e;
}

When it happens

Trigger: Config referencing the default credentials provider (no name given) while no CredentialsProvider bean is deployed in the application.

Common situations: Enabling credential-provider-based passwords without adding the quarkus-credentials extension or a custom CredentialsProvider bean; bean not annotated/discovered (missing @Singleton, wrong package); provider removed in a refactor.

Related errors

• Unable to find the credentials provider named '" + name + "'
• multiple beans with type + type.getName() + found for TLS co
• Invalid keystore '" + name + "' - The keystore cannot be con
• Unable to read file + path
• Invalid JKS key store configuration for certificate '" + nam

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b8158a2f53aebcb5. Report an issue: GitHub.