> ## Documentation Index > Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt > Use this file to discover all available pages before exploring further. # Kafka Schema Registry Client Configuration > The Schema Registry client properties StreamNative Cloud honors—connection, authentication, serializer behavior, and caching. Reference for the properties the Confluent Schema Registry client accepts, and how they behave against StreamNative Cloud. Properties are set on the same `Properties` object as your Kafka client configuration. In non-Java clients, the equivalent keys use the same names. ## Connection | Property | Default | Description | | ------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------- | | `schema.registry.url` | N/A | The registry endpoint. Required. Accepts a comma-separated list. On a Pulsar cluster, remember the `/kafka` suffix. | | `schema.registry.url.randomize` | `false` | Randomize the order of URLs when several are given. | | `http.connect.timeout.ms` | `60000` | Connection timeout. | | `http.read.timeout.ms` | `60000` | Read timeout. | | `proxy.host` | N/A | HTTP proxy host, if your network requires one. | | `proxy.port` | `-1` | HTTP proxy port. | ## Retries | Property | Default | Description | | --------------------- | ------- | ------------------------------------ | | `max.retries` | `3` | Retry attempts for a failed request. | | `retries.wait.ms` | `1000` | Initial wait between retries. | | `retries.max.wait.ms` | `20000` | Maximum wait between retries. | ## Basic authentication | Property | Description | | ------------------------------- | ----------------------- | | `basic.auth.credentials.source` | Set to `USER_INFO`. | | `basic.auth.user.info` | `:`. | The username is ignored—only the password is evaluated as the credential. Pass any non-empty placeholder. ## OAuth2 | Property | Description | | ----------------------------------- | ----------------------------------------------------------------------------------- | | `bearer.auth.credentials.source` | Set to `CUSTOM`. | | `bearer.auth.custom.provider.class` | `io.streamnative.pulsar.handlers.kop.security.oauth.schema.OauthCredentialProvider` | Requires the `io.streamnative.pulsar.handlers:oauth-client` dependency and the Kafka Java client. See [Connect](/kafka/governance/sr/connect#oauth2). `bearer.auth.logical.cluster` and `bearer.auth.identity.pool.id` are Confluent Cloud plumbing and have no effect here. The generic OpenID Connect (OIDC) properties—`bearer.auth.issuer.endpoint.url`, `bearer.auth.client.id`, `bearer.auth.client.secret`, `bearer.auth.scope`—are superseded by the custom provider class above. ## TLS The standard `ssl.*` family applies when connecting over TLS or using mTLS: | Property | Description | | ------------------------------------------------------- | -------------------------------------------- | | `schema.registry.ssl.truststore.location` | Truststore path. | | `schema.registry.ssl.truststore.password` | Truststore password. | | `schema.registry.ssl.keystore.location` | Keystore path, for mTLS. | | `schema.registry.ssl.keystore.password` | Keystore password. | | `schema.registry.ssl.key.password` | Private key password. | | `schema.registry.ssl.protocol` | TLS protocol version. | | `schema.registry.ssl.endpoint.identification.algorithm` | Hostname verification. Leave at the default. | Don't disable hostname verification to work around a certificate problem. Fix the truststore instead. ## Serializer behavior | Property | Default | Description | | ----------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | `auto.register.schemas` | `true` | Register the schema if the subject doesn't have it. Turn off in production. | | `use.latest.version` | `false` | Use the subject's latest registered version rather than the schema derived from your class. Pair with `auto.register.schemas=false`. | | `normalize.schemas` | `false` | Normalize before registering or looking up. Effective for Avro and Protobuf; **a no-op for JSON Schema**. | | `key.subject.name.strategy` | `TopicNameStrategy` | How the key subject is derived. | | `value.subject.name.strategy` | `TopicNameStrategy` | How the value subject is derived. | | `latest.compatibility.strict` | `true` | With `use.latest.version`, check the derived schema against the latest version. | Subject name strategy classes: * `io.confluent.kafka.serializers.subject.TopicNameStrategy` * `io.confluent.kafka.serializers.subject.RecordNameStrategy` * `io.confluent.kafka.serializers.subject.TopicRecordNameStrategy` See [Subject name strategies](/kafka/governance/sr/fundamentals/serdes#subject-name-strategies), including the caveat about dotted subject names. ## Deserializer behavior | Property | Default | Description | | ------------------------------ | ------- | ------------------------------------------------------------------------------- | | `specific.avro.reader` | `false` | Deserialize into a generated `SpecificRecord` class instead of `GenericRecord`. | | `json.value.type` | N/A | Target class for the JSON Schema deserializer. | | `json.schema.allowed.packages` | N/A | Restrict which packages the JSON deserializer may instantiate. | | `specific.protobuf.value.type` | N/A | Target class for the Protobuf deserializer. | ## Caching | Property | Default | Description | | ------------------------- | ------- | -------------------------------------------- | | `max.schemas.per.subject` | `1000` | Client-side cache size per subject. | | `schema.reflection` | `false` | Use reflection-based Avro schema generation. | Because clients cache lookups—including misses—a schema registered moments ago may not be visible to a running client. See [Troubleshooting](/kafka/governance/sr/reference/troubleshooting). ## Properties with no effect These are accepted by the client library but have no counterpart on StreamNative Cloud: * `bearer.auth.logical.cluster`, `bearer.auth.identity.pool.id`—Confluent Cloud specific. * `context.name.strategy` and anything related to schema contexts—contexts aren't supported. * Rule and Data Contract configuration—see [Unsupported features](/kafka/governance/sr/reference/confluent-compatibility#unsupported-features). ## Next steps Endpoint discovery and worked authentication examples. What these properties change in practice.