risingwavelabs/risingwave · error · ConnectorError

invalid credentials_url scheme '{}', only file://, s3://, an

Error message

invalid credentials_url scheme '{}', only file://, s3://, and absolute file paths are supported

What it means

Raised by `handle_pulsar_credentials_url` when the credentials_url is a valid URL whose scheme is not one of the supported ones (`file`, `s3`; plus the s3 branch handled earlier). Any other scheme — http(s)://, gs://, etc. — is rejected because RisingWave can only fetch Pulsar OAuth credentials from local files or S3.

Source

Thrown at src/connector/src/connector_common/common.rs:786

        &self,
        url: &Url,
        aws_auth_props: &AwsAuthProps,
    ) -> ConnectorResult<(String, Option<NamedTempFile>)> {
        match url.scheme() {
            "s3" => {
                let credentials = load_file_descriptor_from_s3(url, aws_auth_props).await?;
                let temp_file = create_credential_temp_file(&credentials)
                    .context("failed to create temp file for pulsar credentials")?;

                let temp_path = temp_file
                    .path()
                    .to_str()
                    .context("temp file path is not valid UTF-8")?;

                Ok((format!("file://{}", temp_path), Some(temp_file)))
            }
            "file" => Ok((url.to_string(), None)),
            _ => bail!(
                "invalid credentials_url scheme '{}', only file://, s3://, and absolute file paths are supported",
                url.scheme()
            ),
        }
    }
}

#[serde_as]
#[derive(Deserialize, Debug, Clone, WithOptions)]
pub struct KinesisCommon {
    #[serde(rename = "stream", alias = "kinesis.stream.name")]
    pub stream_name: String,
    #[serde(rename = "aws.region", alias = "kinesis.stream.region")]
    pub stream_region: String,
    #[serde(rename = "endpoint", alias = "kinesis.endpoint")]
    pub endpoint: Option<String>,
    #[serde(
        rename = "aws.credentials.access_key_id",

View on GitHub (pinned to 6469eb736d)

Solutions

1. Download the credentials file and reference it with `file:///path/to/creds.json` or an absolute path.
2. Upload the file to S3 and use `s3://bucket/creds.json`.
3. Do not use http(s):// or other object-store schemes; they are not supported for credentials_url.

Example fix

// before
credentials_url = "https://auth.example.com/creds.json"
// after
credentials_url = "s3://my-bucket/pulsar/creds.json"

function validateCredUrlScheme(v) {
  if (v.startsWith('/')) return;
  const scheme = v.split('://')[0];
  if (!['file', 's3'].includes(scheme)) {
    throw new Error(`unsupported scheme '${scheme}', use file://, s3://, or an absolute path`);
  }
}
validateCredUrlScheme(oauth.credentials_url);

try { await createPulsarSource(cfg); } catch (e) { if (String(e).includes('invalid credentials_url scheme')) throw new Error('Only file://, s3://, or absolute paths are supported; download the file or upload it to S3 first.'); throw e; }

When it happens

Trigger: Setting `oauth.credentials_url` to e.g. `https://example.com/creds.json` or `gs://bucket/creds.json` when building a Pulsar client via `resolve_pulsar_credentials_url`.

Common situations: Copying a credentials_url from cloud vendor docs that use http(s), migrating from another streaming platform that supported HTTP URLs, or assuming GCS is supported.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• credentials_url must be a valid URL (s3://, file://) or an a
• need url to be a file or a http based, got {url}
• credentials file does not exist: {}
• Invalid short topic name '{}', it should be in the format of
• The domain only can be specified as 'persistent' or 'non-per

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/46d4c9d7d6b76853. Report an issue: GitHub.