testcontainers/testcontainers-java · error · IllegalArgumentException

Service token cannot have leading or trailing whitespace

Error message

Service token cannot have leading or trailing whitespace

What it means

Thrown by withElasticsearchServiceAccountToken when the token differs from its trimmed value, i.e. it has leading or trailing whitespace. Such whitespace would corrupt the base64 credential string sent to Elasticsearch and cause authentication failures, so the library rejects it up front.

Solutions

1. Trim the token before passing it: withElasticsearchServiceAccountToken(token.trim()).
2. Read files with a newline-stripping helper (e.g. stripping trailing \n/\r\n).
3. Fix whatever produces the token so it is emitted without surrounding whitespace.

Example fix

// before
container.withElasticsearchServiceAccountToken(token);
// after
container.withElasticsearchServiceAccountToken(token.trim());

if (!token.equals(token.trim())) token = token.trim();
container.withElasticsearchServiceAccountToken(token);

String normalizeToken(String t) { return t == null ? null : t.trim(); }

try { container.withElasticsearchServiceAccountToken(token); } catch (IllegalArgumentException e) { container.withElasticsearchServiceAccountToken(token.trim()); }

When it happens

Trigger: Passing a token read from a file/CLI argument that includes a trailing newline or stray spaces, e.g. token = new String(Files.readAllBytes(path)).

Common situations: Reading a token from a text file without trimming the newline; copying a token from a terminal/pager with trailing spaces; shell command substitution preserving newlines.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Kibana credentials cannot have leading or trailing…
• Service account token cannot be empty
• Elasticsearch CA certificate cannot be empty
• The number of replicas must be between 0 and 3 (inclusive)
• Bucket quota cannot be less than 100MB!

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/873afb4fdbfe98af. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:240

     *
     * @param token the service account token
     * @return this container instance
     * @throws IllegalStateException if username/password credentials are already configured
     * @throws IllegalArgumentException if token is blank
     */
    public KibanaContainer withElasticsearchServiceAccountToken(String token) {
        if (elasticsearchUsername != null) {
            throw new IllegalStateException(
                "Conflicting Elasticsearch credentials: provide either a service account token " +
                "or a username/password pair, not both."
            );
        }
        if (StringUtils.isBlank(token)) {
            throw new IllegalArgumentException("Service account token cannot be empty");
        }

        if (!token.equals(token.trim())) {
            throw new IllegalArgumentException("Service token cannot have leading or trailing whitespace");
        }
        this.elasticsearchServiceAccountToken = token;
        return this;
    }

    /**
     * Configures the Elasticsearch CA certificate for HTTPS connections.
     *
     * @param caCertificate the CA certificate in PEM format
     * @return this container instance
     * @throws IllegalArgumentException if certificate is empty
     */
    public KibanaContainer withElasticsearchCaCertificate(byte[] caCertificate) {
        if (caCertificate == null || caCertificate.length == 0) {
            throw new IllegalArgumentException("Elasticsearch CA certificate cannot be empty");
        }
        this.elasticsearchCaCertificate = caCertificate;
        return this;

View on GitHub (pinned to 8e549514e3)