Kafka Schema Registry Client Configuration

Reference for the properties the Confluent Schema Registry client accepts, and how they behave against StreamNative Cloud. Properties are set on the same Properties object as your Kafka client configuration. In non-Java clients, the equivalent keys use the same names.

Connection

Property	Default	Description
`schema.registry.url`	N/A	The registry endpoint. Required. Accepts a comma-separated list. On a Pulsar cluster, remember the `/kafka` suffix.
`schema.registry.url.randomize`	`false`	Randomize the order of URLs when several are given.
`http.connect.timeout.ms`	`60000`	Connection timeout.
`http.read.timeout.ms`	`60000`	Read timeout.
`proxy.host`	N/A	HTTP proxy host, if your network requires one.
`proxy.port`	`-1`	HTTP proxy port.

Retries

Property	Default	Description
`max.retries`	`3`	Retry attempts for a failed request.
`retries.wait.ms`	`1000`	Initial wait between retries.
`retries.max.wait.ms`	`20000`	Maximum wait between retries.

Basic authentication

Property	Description
`basic.auth.credentials.source`	Set to `USER_INFO`.
`basic.auth.user.info`	`<any-user>:<api-key>`.

The username is ignored—only the password is evaluated as the credential. Pass any non-empty placeholder.

OAuth2

Property	Description
`bearer.auth.credentials.source`	Set to `CUSTOM`.
`bearer.auth.custom.provider.class`	`io.streamnative.pulsar.handlers.kop.security.oauth.schema.OauthCredentialProvider`

Requires the io.streamnative.pulsar.handlers:oauth-client dependency and the Kafka Java client. See Connect.

bearer.auth.logical.cluster and bearer.auth.identity.pool.id are Confluent Cloud plumbing and have no effect here. The generic OpenID Connect (OIDC) properties—bearer.auth.issuer.endpoint.url, bearer.auth.client.id, bearer.auth.client.secret, bearer.auth.scope—are superseded by the custom provider class above.

TLS

The standard ssl.* family applies when connecting over TLS or using mTLS:

Property	Description
`schema.registry.ssl.truststore.location`	Truststore path.
`schema.registry.ssl.truststore.password`	Truststore password.
`schema.registry.ssl.keystore.location`	Keystore path, for mTLS.
`schema.registry.ssl.keystore.password`	Keystore password.
`schema.registry.ssl.key.password`	Private key password.
`schema.registry.ssl.protocol`	TLS protocol version.
`schema.registry.ssl.endpoint.identification.algorithm`	Hostname verification. Leave at the default.

Don’t disable hostname verification to work around a certificate problem. Fix the truststore instead.

Serializer behavior

Property	Default	Description
`auto.register.schemas`	`true`	Register the schema if the subject doesn’t have it. Turn off in production.
`use.latest.version`	`false`	Use the subject’s latest registered version rather than the schema derived from your class. Pair with `auto.register.schemas=false`.
`normalize.schemas`	`false`	Normalize before registering or looking up. Effective for Avro and Protobuf; a no-op for JSON Schema.
`key.subject.name.strategy`	`TopicNameStrategy`	How the key subject is derived.
`value.subject.name.strategy`	`TopicNameStrategy`	How the value subject is derived.
`latest.compatibility.strict`	`true`	With `use.latest.version`, check the derived schema against the latest version.

Subject name strategy classes:

io.confluent.kafka.serializers.subject.TopicNameStrategy
io.confluent.kafka.serializers.subject.RecordNameStrategy
io.confluent.kafka.serializers.subject.TopicRecordNameStrategy

See Subject name strategies, including the caveat about dotted subject names.

Deserializer behavior

Property	Default	Description
`specific.avro.reader`	`false`	Deserialize into a generated `SpecificRecord` class instead of `GenericRecord`.
`json.value.type`	N/A	Target class for the JSON Schema deserializer.
`json.schema.allowed.packages`	N/A	Restrict which packages the JSON deserializer may instantiate.
`specific.protobuf.value.type`	N/A	Target class for the Protobuf deserializer.

Caching

Property	Default	Description
`max.schemas.per.subject`	`1000`	Client-side cache size per subject.
`schema.reflection`	`false`	Use reflection-based Avro schema generation.

Because clients cache lookups—including misses—a schema registered moments ago may not be visible to a running client. See Troubleshooting.

Properties with no effect

These are accepted by the client library but have no counterpart on StreamNative Cloud:

bearer.auth.logical.cluster, bearer.auth.identity.pool.id—Confluent Cloud specific.
context.name.strategy and anything related to schema contexts—contexts aren’t supported.
Rule and Data Contract configuration—see Unsupported features.

Introduction

Get Started

Kafka Clusters

Process

Lakehouse

Governance

Migrate

Kafka Clients

Connection

Retries

Basic authentication

OAuth2

TLS

Serializer behavior

Deserializer behavior

Caching

Properties with no effect

Next steps

Connect

Serializers and deserializers

​Connection

​Retries

​Basic authentication

​OAuth2

​TLS

​Serializer behavior

​Deserializer behavior

​Caching

​Properties with no effect

​Next steps

Connect

Serializers and deserializers

Connection

Retries

Basic authentication

OAuth2

TLS

Serializer behavior

Deserializer behavior

Caching

Properties with no effect

Next steps