testcontainers/testcontainers-java · error · IllegalArgumentException

Service account token cannot be empty

Error message

Service account token cannot be empty

What it means

Thrown by KibanaContainer.withElasticsearchServiceAccountToken when the service account token argument is null or blank. Testcontainers validates eagerly at configuration time so the failure surfaces on the host, not after Kibana starts and fails to authenticate. The token is used as base64 'id:api_key' service-account credentials for Elasticsearch.

Solutions

1. Pass a real base64-encoded service account token (created via `bin/elasticsearch-service-tokens create ...`) to withElasticsearchServiceAccountToken.
2. Fix the source of the token (env var, secret, file) so it is non-blank before configuring the container.
3. If you intended username/password auth instead, use withElasticsearchUsername/withElasticsearchPassword and drop the token call.

Example fix

// before
container.withElasticsearchServiceAccountToken(System.getenv("ES_SA_TOKEN"));
// after
String token = System.getenv("ES_SA_TOKEN");
if (token != null && !token.isBlank()) {
    container.withElasticsearchServiceAccountToken(token);
} else {
    throw new IllegalArgumentException("ES_SA_TOKEN env var must be set");
}

if (token == null || token.isBlank()) throw new IllegalArgumentException("ES service account token must be a non-blank string");
container.withElasticsearchServiceAccountToken(token);

boolean isValidToken(String t) { return t != null && !t.isBlank(); }

try { container.withElasticsearchServiceAccountToken(token); } catch (IllegalArgumentException e) { log.error("Invalid ES service account token", e); throw new ConfigException("ES_SA_TOKEN is unset or blank"); }

When it happens

Trigger: Calling withElasticsearchServiceAccountToken(null), withElasticsearchServiceAccountToken("") or a whitespace-only string such as " ".

Common situations: Reading the token from an environment variable or config file that is unset/empty before passing it in; a YAML property binding that yields an empty string.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• Elasticsearch CA certificate cannot be empty
• Service token cannot have leading or trailing whitespace
• pathInHomeFolder must not be empty
• The number of replicas must be between 0 and 3 (inclusive)
• Bucket quota cannot be less than 100MB!

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/cb7df13566e55bcb. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:236

    }

    /**
     * Configures a service account token for Elasticsearch authentication.
     *
     * @param token the service account token
     * @return this container instance
     * @throws IllegalStateException if username/password credentials are already configured
     * @throws IllegalArgumentException if token is blank
     */
    public KibanaContainer withElasticsearchServiceAccountToken(String token) {
        if (elasticsearchUsername != null) {
            throw new IllegalStateException(
                "Conflicting Elasticsearch credentials: provide either a service account token " +
                "or a username/password pair, not both."
            );
        }
        if (StringUtils.isBlank(token)) {
            throw new IllegalArgumentException("Service account token cannot be empty");
        }

        if (!token.equals(token.trim())) {
            throw new IllegalArgumentException("Service token cannot have leading or trailing whitespace");
        }
        this.elasticsearchServiceAccountToken = token;
        return this;
    }

    /**
     * Configures the Elasticsearch CA certificate for HTTPS connections.
     *
     * @param caCertificate the CA certificate in PEM format
     * @return this container instance
     * @throws IllegalArgumentException if certificate is empty
     */
    public KibanaContainer withElasticsearchCaCertificate(byte[] caCertificate) {
        if (caCertificate == null || caCertificate.length == 0) {

View on GitHub (pinned to 8e549514e3)