Repository: quarkusio/quarkus
Issue: Warning message if quarkus.oidc.application-type=service

### Describe the bug

I got the warning message:

> Secret key for encrypting tokens is missing, auto-generating it

despite `quarkus.oidc.application-type=service` and I am not using cookies.

https://github.com/quarkusio/quarkus/blob/0e63bfcfc468a48081c0ed54771d37ea75bcec3b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java#L77-L78

### Quarkus version

3.0.2.Final

### Workaround

Set `quarkus.oidc.token-state-manager.encryption-required=false`

Changed files:
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java

diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
index 42ffc9ea3a1..936cae8f81c 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
@@ -187,7 +187,7 @@ private Uni<TenantConfigContext> createTenantContext(Vertx vertx, OidcTenantConf
                 throw new ConfigurationException("'quarkus.oidc.auth-server-url' property must be configured");
             }
             OidcCommonUtils.verifyEndpointUrl(oidcConfig.getAuthServerUrl().get());
-            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, isServiceApp(oidcConfig), true);
+            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, OidcUtils.isServiceApp(oidcConfig), true);
         } catch (ConfigurationException t) {
             return Uni.createFrom().failure(t);
         }
@@ -196,7 +196,7 @@ private Uni<TenantConfigContext> createTenantContext(Vertx vertx, OidcTenantConf
             throw new ConfigurationException(
                     "UserInfo is not required but UserInfo is expected to be the source of authorization roles");
         }
-        if (oidcConfig.token.verifyAccessTokenWithUserInfo.orElse(false) && !isWebApp(oidcConfig)
+        if (oidcConfig.token.verifyAccessTokenWithUserInfo.orElse(false) && !OidcUtils.isWebApp(oidcConfig)
                 && !enableUserInfo(oidcConfig)) {
             throw new ConfigurationException(
                     "UserInfo is not required but 'verifyAccessTokenWithUserInfo' is enabled");
@@ -207,7 +207,7 @@ private Uni<TenantConfigContext> createTenantContext(Vertx vertx, OidcTenantConf
         }
 
         if (!oidcConfig.discoveryEnabled.orElse(true)) {
-            if (!isServiceApp(oidcConfig)) {
+            if (!OidcUtils.isServiceApp(oidcConfig)) {
                 if (!oidcConfig.authorizationPath.isPresent() || !oidcConfig.tokenPath.isPresent()) {
                     throw new ConfigurationException(
                             "'web-app' applications must have 'authorization-path' and 'token-path' properties "
@@ -228,7 +228,7 @@ private Uni<TenantConfigContext> createTenantContext(Vertx vertx, OidcTenantConf
             }
         }
 
-        if (isServiceApp(oidcConfig)) {
+        if (OidcUtils.isServiceApp(oidcConfig)) {
             if (oidcConfig.token.refreshExpired) {
                 throw new ConfigurationException(
                         "The 'token.refresh-expired' property can only be enabled for " + ApplicationType.WEB_APP
@@ -294,7 +294,7 @@ private static boolean enableUserInfo(OidcTenantConfig oidcConfig) {
     }
 
     private static TenantConfigContext createTenantContextFromPublicKey(OidcTenantConfig oidcConfig) {
-        if (!isServiceApp(oidcConfig)) {
+        if (!OidcUtils.isServiceApp(oidcConfig)) {
             throw new ConfigurationException("'public-key' property can only be used with the 'service' applications");
         }
         LOG.debug("'public-key' property for the local token verification is set,"
@@ -443,6 +443,7 @@ public Uni<OidcProviderClient> apply(OidcConfigurationMetadata metadata, Throwab
                         }
                         return Uni.createFrom().item(new OidcProviderClient(client, metadata, oidcConfig));
                     }
+
                 });
     }
 
@@ -459,12 +460,4 @@ private static OidcConfigurationMetadata createLocalMetadata(OidcTenantConfig oi
                 introspectionUri, authorizationUri, jwksUri, userInfoUri, endSessionUri,
                 oidcConfig.token.issuer.orElse(null));
     }
-
-    private static boolean isServiceApp(OidcTenantConfig oidcConfig) {
-        return ApplicationType.SERVICE.equals(oidcConfig.applicationType.orElse(ApplicationType.SERVICE));
-    }
-
-    private static boolean isWebApp(OidcTenantConfig oidcConfig) {
-        return ApplicationType.WEB_APP.equals(oidcConfig.applicationType.orElse(ApplicationType.SERVICE));
-    }
 }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
index 8aa82db7da3..d8c99953005 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
@@ -29,6 +29,7 @@
 import io.quarkus.oidc.AuthorizationCodeTokens;
 import io.quarkus.oidc.OIDCException;
 import io.quarkus.oidc.OidcTenantConfig;
+import io.quarkus.oidc.OidcTenantConfig.ApplicationType;
 import io.quarkus.oidc.OidcTenantConfig.Authentication;
 import io.quarkus.oidc.RefreshToken;
 import io.quarkus.oidc.TokenIntrospection;
@@ -78,6 +79,14 @@ private OidcUtils() {
 
     }
 
+    public static boolean isServiceApp(OidcTenantConfig oidcConfig) {
+        return ApplicationType.SERVICE.equals(oidcConfig.applicationType.orElse(ApplicationType.SERVICE));
+    }
+
+    public static boolean isWebApp(OidcTenantConfig oidcConfig) {
+        return ApplicationType.WEB_APP.equals(oidcConfig.applicationType.orElse(ApplicationType.SERVICE));
+    }
+
     public static boolean isEncryptedToken(String token) {
         return new StringTokenizer(token, ".").countTokens() == 5;
     }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java
index 9ff389f5acd..d748c56035f 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContext.java
@@ -47,8 +47,9 @@ public TenantConfigContext(OidcProvider client, OidcTenantConfig config, boolean
         this.oidcConfig = config;
         this.ready = ready;
 
-        pkceSecretKey = provider != null && provider.client != null ? createPkceSecretKey(config) : null;
-        tokenEncSecretKey = provider != null && provider.client != null ? createTokenEncSecretKey(config) : null;
+        boolean isService = OidcUtils.isServiceApp(config);
+        pkceSecretKey = !isService && provider != null && provider.client != null ? createPkceSecretKey(config) : null;
+        tokenEncSecretKey = !isService && provider != null && provider.client != null ? createTokenEncSecretKey(config) : null;
     }
 
     private static SecretKey createPkceSecretKey(OidcTenantConfig config) {