A Cerbos Hub PDP needs three credentials and the right deployment ID

TL;DR

Set CERBOSHUBDEPLOYMENTID, CERBOSHUBCLIENTID, and CERBOSHUBCLIENT_SECRET (or the equivalent hub credentials block in the config file) and double-check the deployment ID matches the environment you intend, since a wrong ID loads the wrong policies with no error.

Steps

1. Set CERBOSHUBDEPLOYMENTID, CERBOSHUBCLIENTID, and CERBOSHUBCLIENTSECRET (or the equivalent hub credentials block in the config file) and double-check the deployment ID matches the environment you intend, since a wrong ID loads the wrong policies with no error. Generate client credentials with the Read only role for PDPs that just receive bundles, and save the client secret immediately because it cannot be shown again. Give each PDP a CERBOSHUBPDPID name so you can tell instances apart on the Hub monitoring page.

When to use

You are seeing this: Give each PDP a CERBOSHUBPDP_ID name so you can tell instances apart on the Hub monitoring page. Use this skill when you run into "A Cerbos Hub PDP needs three credentials and the right deployment ID".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Service Policy Decision Points): documents a gotcha that trips agents wiring Cerbos to Cerbos Hub. A connected PDP needs three pieces of config: the deployment ID (which deployment's policies to load), plus a client ID and client secret generated from the deployment's Client credentials tab. The client secret is shown once at creation and cannot be recovered, and pointing the PDP at the wrong deployment ID silently loads a different deployment's policies.

Verified resolution: Set CERBOSHUBDEPLOYMENTID, CERBOSHUBCLIENTID, and CERBOSHUBCLIENTSECRET (or the equivalent hub credentials block in the config file) and double-check the deployment ID matches the environment you intend, since a wrong ID loads the wrong policies with no error. Generate client credentials with the Read only role for PDPs that just receive bundles, and save the client secret immediately because it cannot be shown again. Give each PDP a CERBOSHUBPDPID name so you can tell instances apart on the Hub monitoring page.

Source URL: https://docs.cerbos.dev/cerbos-hub/decision-points.html