# bearerOnly client does not import credential secret

**URL:** <https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786>\
**Category:** Configuring the server\
**Tags:** admin-console, authentication\
**Created:** [July 3, 2024, 7:58am UTC](https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786 "2024-07-03T07:58:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MnemoDes](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@MnemoDes](https://forum.keycloak.org/u/MnemoDes)\
**Post date:** [July 3, 2024, 7:58am UTC](https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786/1 "2024-07-03T07:58:28Z")

</div>

Since we updated to v25.0.1, we noticed that our client marked as bearerOnly is not importing its client secret.

We have our importing client as:

{  
“protocol”: “openid-connect”,  
“clientId”: “{{ client\_back }}”,  
“name”: “{{ client\_back }}”,  
“description”: “{{ client\_description }}”,  
“enabled”: true,  
“publicClient”: false,  
“alwaysDisplayInConsole”: false,  
“clientAuthenticatorType”: “client-secret”,  
“secret”: “{{ backend\_clientSecret }}”,  
“bearerOnly”: false,  
“consentRequired”: false,  
“standardFlowEnabled”: false,  
“implicitFlowEnabled”: false,  
“directAccessGrantsEnabled”: true,  
“serviceAccountsEnabled”: true,  
“authorizationServicesEnabled”: false  
}

We tested to set the bearerOnly to false for the client, and although the secret is being imported the client doesn’t work properly,.

It worked fine on the previous version.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [July 3, 2024, 8:54am UTC](https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786/2 "2024-07-03T08:54:19Z")

</div>

This might help:

> <https://github.com/keycloak/keycloak/issues/30543>
>
> \### Before reporting an issue
> 
> \- \[X\] I have read and understood the above terms …for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
> 
> \### Area
> 
> import-export
> 
> \### Describe the bug
> 
> I have an exported test realm configuration that I use for CI purposes. During CI, I spin a keycloak importing that realm configuration, which also includes static client secrets.
> 
> In the Keycloak 25.0.0 version, the \`--import-realm\` imports the client but no longer imports the secret. Exporting the realm including its clients, after creating a new secret for that client shows the secret in the exported json. Which means that only the import does not work.
> 
> 
> 
> \### Version
> 
> 25.0.0
> 
> \### Regression
> 
> \- \[X\] The issue is a regression
> 
> \### Expected behavior
> 
> Using \`--import-realm\` with a realm json that includes secrets might contain security risks when done in production, but it is useful in other environments. The realm should be imported as-is, including its clients' secrets.
> 
> \### Actual behavior
> 
> The realm is imported but the secrets are empty.
> 
> \### How to Reproduce?
> 
> Export a realm configuration, including its clients.
> 
> Create a new clean Keycloak v25.0.0 instance using \`--import-realm\` with the realm-export.json mounted in \`/opt/keycloak/data/import/realm-export.json\`.
> 
> \### Anything else?
> 
> \_No response\_

---

<div class="post-metadata">

**Author:** ![MnemoDes](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@MnemoDes](https://forum.keycloak.org/u/MnemoDes)\
**Post date:** [July 3, 2024, 9:21am UTC](https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786/3 "2024-07-03T09:21:26Z")

</div>

Hello dasniko,

We’ve already tried to switch bearerOnly to false. This makes the secret being imported correctly, but the client doesn’t work properly when changing this property.

Any other suggestion?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![CyborTronik](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/cybortronik/32/11274_2.png) [@CyborTronik](https://forum.keycloak.org/u/CyborTronik)\
**Post date:** [September 19, 2024, 10:09am UTC](https://forum.keycloak.org/t/beareronly-client-does-not-import-credential-secret/26786/4 "2024-09-19T10:09:07Z")

</div>

Having the same issue. any updates on that?  
@dasniko the bearerOnly is false, as per your link and doesn’t work anyway