rails/rails · error · ArgumentError

Missing required ingress credentials

Error message

Missing required ingress credentials

What it means

Raises ArgumentError('Missing required ingress credentials') from ActionMailbox::BaseController#authenticate_by_password when neither Rails.application.credentials.dig(:action_mailbox, :ingress_password) nor ENV['RAILS_INBOUND_EMAIL_PASSWORD'] is set. Action Mailbox ingress controllers (for Mailgun, SendGrid, Postmark, etc.) authenticate inbound email webhooks via HTTP Basic Auth with a shared password; without it configured, the controller cannot verify the incoming mail is legitimate and refuses to process it.

Source

Thrown at actionmailbox/app/controllers/action_mailbox/base_controller.rb:26

    before_action :ensure_configured

    private
      def ensure_configured
        unless ActionMailbox.ingress == ingress_name
          head :not_found
        end
      end

      def ingress_name
        self.class.name.remove(/\AActionMailbox::Ingresses::/, /::InboundEmailsController\z/).underscore.to_sym
      end


      def authenticate_by_password
        if password.present?
          http_basic_authenticate_or_request_with name: "actionmailbox", password: password, realm: "Action Mailbox"
        else
          raise ArgumentError, "Missing required ingress credentials"
        end
      end

      def password
        Rails.app.credentials.dig(:action_mailbox, :ingress_password) || ENV["RAILS_INBOUND_EMAIL_PASSWORD"]
      end
  end
end

View on GitHub (pinned to 817fc2a147)

Solutions

1. Set the ingress password in credentials: EDITOR=vim bin/rails credentials:edit and add action_mailbox: ingress_password: 'your_secret'.
2. Or set the environment variable: export RAILS_INBOUND_EMAIL_PASSWORD=your_secret (ensure it's set in production via your hosting platform's env config).
3. Configure the ingress provider (Mailgun/SendGrid) to send the same password via HTTP Basic Auth username 'actionmailbox'.
4. Verify with Rails.application.credentials.dig(:action_mailbox, :ingress_password) in the Rails console.

Example fix

# before
# RAILS_INBOUND_EMAIL_PASSWORD not set
# credentials lack action_mailbox.ingress_password

# after - config/credentials.yml.enc
action_mailbox:
  ingress_password: <%= ENV["RAILS_INBOUND_EMAIL_PASSWORD"] %>

# then set in production env:
# RAILS_INBOUND_EMAIL_PASSWORD=a_strong_secret

pwd = Rails.application.credentials.dig(:action_mailbox, :ingress_password) || ENV['RAILS_INBOUND_EMAIL_PASSWORD']
raise 'Set RAILS_INBOUND_EMAIL_PASSWORD' if pwd.blank?

When it happens

Trigger: An Action Mailbox ingress endpoint (e.g., /rails/action_mailbox/mailgun/inbound_emails) receives a request but the ingress password was never set. Common when deploying Action Mailbox for the first time, or when credentials differ between environments, or when ENV var isn't set in production.

Common situations: New Action Mailbox setup without running rails credentials:edit to set the password; production deployment missing the RAILS_INBOUND_EMAIL_PASSWORD env var; CI/staging environments that never configured ingress credentials; Docker images that don't propagate the env var.

Related errors

• Missing required Mailgun Signing key. Set action_mailbox.mai
• Missing required Mandrill API key. Set action_mailbox.mandri
• Path relative URL redirect detected: #{url.inspect}
• Invalid request forgery protection method, use :null_session
• Invalid CSRF token storage strategy, use :session, :cookie,

AI-assisted analysis of rails/rails@817fc2a147 (2026-08-04). Data as JSON: /data/errors/540685b64c511665.json. Report an issue: GitHub.