Bitbucket Data Center fails to start due to an exception: Backend properties in secret service configuration file is invalid, review the secrets-config.yaml file
Platform Notice: Data Center Only - This article only applies to Atlassian apps on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Bitbucket Data Center fails to start due to an exception: Backend properties in secret service configuration file is invalid, review the secrets-config.yaml file
Bitbucket Data Center fails to start, produces no application logs, and its Java process is not running.
Diagnosis
The $BITBUCKET_HOME/log/launcher.log shows the following error:
This exception occurs while Bitbucket is initialising the Secret Service backend, which handles the encryption of credentials and other properties.
com.atlassian.secrets.api.SecretServiceException
09:30:50.782 [main] ERROR org.springframework.boot.SpringApplication -- Application run failed
com.atlassian.secrets.api.SecretServiceException: Failed to initialize secret service. This may be caused by incorrect configuration or a missing/corrupt encryption key.
...
Caused by: com.atlassian.secrets.api.SecretServiceException: Backend properties in secret service configuration file is invalid, review the secrets-config.yaml fileCause
The Secret Service configuration file, $BITBUCKET_HOME/shared/secrets-config.yaml, is present, but Bitbucket cannot create the service backend from the information in it.
The secrets-config.yaml file typically contains the following structure:
default: "ATL_SECRET_AES_256_2026-03-03-111929_7c20604c-2480-47c6-8cbc-e473996c18a6"
backends:
ATL_SECRET_AES_256_2026-03-03-111929_7c20604c-2480-47c6-8cbc-e473996c18a6:
type: "AES"
properties:
key: "AES_KEY_DIR/ATL_SECRET_AES_256_2026-03-03-111929_7c20604c-2480-47c6-8cbc-e473996c18a6"The
secrets-config.yamlfile is located in the$BITBUCKET_HOME/shareddirectory and should be readable by the Bitbucket service user.The
defaultvalue (e.g.ATL_SECRET_AES_256_2026-03-03-111929_7c20604c-2480-47c6-8cbc-e473996c18a6) matches a backend ID underbackendsFor an
AEStype backend, the referenced key file (e.g.ATL_SECRET_AES_256_2026-03-03-111929_7c20604c-2480-47c6-8cbc-e473996c18a6) should exist in the$BITBUCKET_HOME/shared/keys/directory and should be readable by the Bitbucket user
Possible causes for the issue:
The AES key path in
secrets-config.yamlpoints to a missing, moved, unreadable, or corrupt key file.The AES key file was replaced after secrets were already stored
secrets-config.yamlwas restored from backup, or copied from another instance without copying the correspondingkeysfiles.
Solution
Restore a known good copy of the following, taken from the same Bitbucket instance and point in time.
$BITBUCKET_HOME/shared/secrets-config.yaml$BITBUCKET_HOME/shared/keys/
Confirm ownership and permissions allow the Bitbucket process user to read the secrets-config.yaml and files under the keys directory.
Afterward, restart Bitbucket.
Was this helpful?