diff --git a/apps/emqx/src/emqx_authentication_config.erl b/apps/emqx/src/emqx_authentication_config.erl
index 7e7419a52..31c6ad8cd 100644
--- a/apps/emqx/src/emqx_authentication_config.erl
+++ b/apps/emqx/src/emqx_authentication_config.erl
@@ -155,8 +155,8 @@ do_check_config(Type, Config, Module) ->
                 fun(C) ->
                         Key = list_to_binary(?EMQX_AUTHENTICATION_CONFIG_ROOT_NAME),
                         AtomKey = list_to_atom(?EMQX_AUTHENTICATION_CONFIG_ROOT_NAME),
-                        R = hocon_schema:check_plain(Module, #{Key => C},
-                                                     #{atom_key => true}),
+                        R = hocon_tconf:check_plain(Module, #{Key => C},
+                                                    #{atom_key => true}),
                         maps:get(AtomKey, R)
                 end
         end,
diff --git a/apps/emqx/src/emqx_config.erl b/apps/emqx/src/emqx_config.erl
index ab01a4b57..f4a0b75b1 100644
--- a/apps/emqx/src/emqx_config.erl
+++ b/apps/emqx/src/emqx_config.erl
@@ -236,7 +236,7 @@ get_raw(KeyPath, Default) -> do_get(?RAW_CONF, KeyPath, Default).
 put_raw(Config) ->
     maps:fold(fun(RootName, RootV, _) ->
             ?MODULE:put_raw([RootName], RootV)
-        end, ok, hocon_schema:get_value([], Config)).
+        end, ok, hocon_maps:ensure_plain(Config)).
 
 -spec put_raw(emqx_map_lib:config_key_path(), term()) -> ok.
 put_raw(KeyPath, Config) -> do_put(?RAW_CONF, KeyPath, Config).
@@ -299,7 +299,7 @@ merge_envs(SchemaMod, RawConf) ->
              format => map,
              apply_override_envs => true
             },
-    hocon_schema:merge_env_overrides(SchemaMod, RawConf, all, Opts).
+    hocon_tconf:merge_env_overrides(SchemaMod, RawConf, all, Opts).
 
 -spec check_config(module(), raw_config()) -> {AppEnvs, CheckedConf}
     when AppEnvs :: app_envs(), CheckedConf :: config().
@@ -313,7 +313,7 @@ check_config(SchemaMod, RawConf, Opts0) ->
              },
     Opts = maps:merge(Opts0, Opts1),
     {AppEnvs, CheckedConf} =
-        hocon_schema:map_translate(SchemaMod, RawConf, Opts),
+        hocon_tconf:map_translate(SchemaMod, RawConf, Opts),
     {AppEnvs, emqx_map_lib:unsafe_atom_key_map(CheckedConf)}.
 
 -spec fill_defaults(raw_config()) -> map().
@@ -330,7 +330,7 @@ fill_defaults(RawConf) ->
 
 -spec fill_defaults(module(), raw_config()) -> map().
 fill_defaults(SchemaMod, RawConf) ->
-    hocon_schema:check_plain(SchemaMod, RawConf,
+    hocon_tconf:check_plain(SchemaMod, RawConf,
         #{nullable => true, only_fill_defaults => true},
         root_names_from_conf(RawConf)).
 
diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 935bef979..6da3ed723 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -1107,7 +1107,7 @@ base_listener() ->
 %% utils
 -spec(conf_get(string() | [string()], hocon:config()) -> term()).
 conf_get(Key, Conf) ->
-    V = hocon_schema:get_value(Key, Conf),
+    V = hocon_maps:get(Key, Conf),
     case is_binary(V) of
         true ->
             binary_to_list(V);
@@ -1116,7 +1116,7 @@ conf_get(Key, Conf) ->
     end.
 
 conf_get(Key, Conf, Default) ->
-    V = hocon_schema:get_value(Key, Conf, Default),
+    V = hocon_maps:get(Key, Conf, Default),
     case is_binary(V) of
         true ->
             binary_to_list(V);
diff --git a/apps/emqx/test/emqx_authentication_SUITE.erl b/apps/emqx/test/emqx_authentication_SUITE.erl
index 362f6807b..c02685884 100644
--- a/apps/emqx/test/emqx_authentication_SUITE.erl
+++ b/apps/emqx/test/emqx_authentication_SUITE.erl
@@ -59,8 +59,8 @@ enable(_) -> undefined.
 
 check_config(C) ->
     #{config := R} =
-        hocon_schema:check_plain(?MODULE, #{<<"config">> => C},
-                                 #{atom_key => true}),
+        hocon_tconf:check_plain(?MODULE, #{<<"config">> => C},
+                                #{atom_key => true}),
     R.
 
 create(_AuthenticatorID, _Config) ->
diff --git a/apps/emqx/test/emqx_schema_tests.erl b/apps/emqx/test/emqx_schema_tests.erl
index 91192deff..9a90c5de6 100644
--- a/apps/emqx/test/emqx_schema_tests.erl
+++ b/apps/emqx/test/emqx_schema_tests.erl
@@ -81,15 +81,15 @@ validate(Schema, Data0) ->
                  , keyfile => <<"keyfile">>
                  },
     #{ssl_opts := Checked} =
-        hocon_schema:check_plain(Sc, #{<<"ssl_opts">> => Data},
-                                 #{atom_key => true}),
+        hocon_tconf:check_plain(Sc, #{<<"ssl_opts">> => Data},
+                                #{atom_key => true}),
     Checked.
 
 ciperhs_schema_test() ->
     Sc = emqx_schema:ciphers_schema(undefined),
     WSc = #{roots => [{ciphers, Sc}]},
     ?assertThrow({_, [{validation_error, _}]},
-                 hocon_schema:check_plain(WSc, #{<<"ciphers">> => <<"foo,bar">>})).
+                 hocon_tconf:check_plain(WSc, #{<<"ciphers">> => <<"foo,bar">>})).
 
 bad_tls_version_test() ->
     Sc = emqx_schema:server_ssl_opts_schema(#{}, false),
diff --git a/apps/emqx_authn/src/emqx_authn.erl b/apps/emqx_authn/src/emqx_authn.erl
index 7bae55559..626adc636 100644
--- a/apps/emqx_authn/src/emqx_authn.erl
+++ b/apps/emqx_authn/src/emqx_authn.erl
@@ -59,8 +59,8 @@ do_check_config(#{<<"mechanism">> := Mec} = Config, Opts) ->
         false ->
             throw({unknown_handler, Key});
         {_, ProviderModule} ->
-            hocon_schema:check_plain(ProviderModule, #{?CONF_NS_BINARY => Config},
-                                     Opts#{atom_key => true})
+            hocon_tconf:check_plain(ProviderModule, #{?CONF_NS_BINARY => Config},
+                                    Opts#{atom_key => true})
     end.
 
 atom(Bin) ->
diff --git a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
index f461ae362..3cfa49580 100644
--- a/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
+++ b/apps/emqx_authn/src/simple_authn/emqx_authn_http.erl
@@ -332,4 +332,4 @@ to_bin(L) when is_list(L) ->
     list_to_binary(L).
 
 get_conf_val(Name, Conf) ->
-    hocon_schema:get_value(?CONF_NS ++ "." ++ Name, Conf).
+    hocon_maps:get(?CONF_NS ++ "." ++ Name, Conf).
diff --git a/apps/emqx_authn/test/emqx_authn_mnesia_SUITE.erl b/apps/emqx_authn/test/emqx_authn_mnesia_SUITE.erl
index b54d6e9fe..fbda75a0d 100644
--- a/apps/emqx_authn/test/emqx_authn_mnesia_SUITE.erl
+++ b/apps/emqx_authn/test/emqx_authn_mnesia_SUITE.erl
@@ -62,7 +62,7 @@ t_check_schema(_Config) ->
         }
     },
 
-    hocon_schema:check_plain(emqx_authn_mnesia, ?CONF(ConfigOk)),
+    hocon_tconf:check_plain(emqx_authn_mnesia, ?CONF(ConfigOk)),
 
     ConfigNotOk = #{
         <<"mechanism">> => <<"password-based">>,
@@ -76,7 +76,7 @@ t_check_schema(_Config) ->
     ?assertException(
         throw,
         {emqx_authn_mnesia, _},
-        hocon_schema:check_plain(emqx_authn_mnesia, ?CONF(ConfigNotOk))).
+        hocon_tconf:check_plain(emqx_authn_mnesia, ?CONF(ConfigNotOk))).
 
 t_create(_) ->
     Config0 = config(),
diff --git a/apps/emqx_authz/src/emqx_authz.erl b/apps/emqx_authz/src/emqx_authz.erl
index 97e589723..48c62ac47 100644
--- a/apps/emqx_authz/src/emqx_authz.erl
+++ b/apps/emqx_authz/src/emqx_authz.erl
@@ -320,7 +320,7 @@ do_authorize(Client, PubSub, Topic,
 check_sources(RawSources) ->
     Schema = #{roots => emqx_authz_schema:fields("authorization"), fields => #{}},
     Conf = #{<<"sources">> => RawSources},
-    #{sources := Sources} = hocon_schema:check_plain(Schema, Conf, #{atom_key => true}),
+    #{sources := Sources} = hocon_tconf:check_plain(Schema, Conf, #{atom_key => true}),
     Sources.
 
 take(Type) -> take(Type, lookup()).
diff --git a/apps/emqx_authz/src/emqx_authz_api_sources.erl b/apps/emqx_authz/src/emqx_authz_api_sources.erl
index 6d46fb9be..34881d248 100644
--- a/apps/emqx_authz/src/emqx_authz_api_sources.erl
+++ b/apps/emqx_authz/src/emqx_authz_api_sources.erl
@@ -415,7 +415,7 @@ get_raw_sources() ->
     Schema = #{roots => emqx_authz_schema:fields("authorization"), fields => #{}},
     Conf = #{<<"sources">> => RawSources},
     Options = #{only_fill_defaults => true},
-    #{<<"sources">> := Sources} = hocon_schema:check_plain(Schema, Conf, Options),
+    #{<<"sources">> := Sources} = hocon_tconf:check_plain(Schema, Conf, Options),
     merge_default_headers(Sources).
 
 merge_default_headers(Sources) ->
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index 5b005d3aa..9ba6458a0 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -211,9 +211,9 @@ check_ssl_opts(Conf)
   when Conf =:= #{} ->
     true;
 check_ssl_opts(Conf) ->
-    case emqx_authz_http:parse_url(hocon_schema:get_value("config.url", Conf)) of
+    case emqx_authz_http:parse_url(hocon_maps:get("config.url", Conf)) of
         #{scheme := https} ->
-            case hocon_schema:get_value("config.ssl.enable", Conf) of
+            case hocon_maps:get("config.ssl.enable", Conf) of
                 true -> ok;
                 false -> false
             end;
@@ -225,8 +225,8 @@ check_headers(Conf)
     when Conf =:= #{} ->
     true;
 check_headers(Conf) ->
-    Method = to_bin(hocon_schema:get_value("config.method", Conf)),
-    Headers = hocon_schema:get_value("config.headers", Conf),
+    Method = to_bin(hocon_maps:get("config.method", Conf)),
+    Headers = hocon_maps:get("config.headers", Conf),
     Method =:= <<"post">> orelse (not lists:member(<<"content-type">>, Headers)).
 
 union_array(Item) when is_list(Item) ->
diff --git a/apps/emqx_conf/src/emqx_conf_schema.erl b/apps/emqx_conf/src/emqx_conf_schema.erl
index a916d3a25..cb6d2e993 100644
--- a/apps/emqx_conf/src/emqx_conf_schema.erl
+++ b/apps/emqx_conf/src/emqx_conf_schema.erl
@@ -757,10 +757,10 @@ sort_log_levels(Levels) ->
 %% utils
 -spec(conf_get(string() | [string()], hocon:config()) -> term()).
 conf_get(Key, Conf) ->
-    ensure_list(hocon_schema:get_value(Key, Conf)).
+    ensure_list(hocon_maps:get(Key, Conf)).
 
 conf_get(Key, Conf, Default) ->
-    ensure_list(hocon_schema:get_value(Key, Conf, Default)).
+    ensure_list(hocon_maps:get(Key, Conf, Default)).
 
 filter(Opts) ->
     [{K, V} || {K, V} <- Opts, V =/= undefined].
diff --git a/apps/emqx_connector/src/emqx_connector_http.erl b/apps/emqx_connector/src/emqx_connector_http.erl
index 37f7b4321..3f1033748 100644
--- a/apps/emqx_connector/src/emqx_connector_http.erl
+++ b/apps/emqx_connector/src/emqx_connector_http.erl
@@ -313,8 +313,8 @@ check_ssl_opts(Conf) ->
     check_ssl_opts("base_url", Conf).
 
 check_ssl_opts(URLFrom, Conf) ->
-    #{scheme := Scheme} = hocon_schema:get_value(URLFrom, Conf),
-    SSL= hocon_schema:get_value("ssl", Conf),
+    #{scheme := Scheme} = hocon_maps:get(URLFrom, Conf),
+    SSL= hocon_maps:get("ssl", Conf),
     case {Scheme, maps:get(enable, SSL, false)} of
         {http, false} -> true;
         {https, true} -> true;
diff --git a/apps/emqx_dashboard/src/emqx_dashboard_swagger.erl b/apps/emqx_dashboard/src/emqx_dashboard_swagger.erl
index 802bde288..ac7b86d19 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard_swagger.erl
+++ b/apps/emqx_dashboard/src/emqx_dashboard_swagger.erl
@@ -147,10 +147,10 @@ translate_req(Request, #{module := Module, path := Path, method := Method}, Chec
     end.
 
 check_and_translate(Schema, Map, Opts) ->
-    hocon_schema:check_plain(Schema, Map, Opts).
+    hocon_tconf:check_plain(Schema, Map, Opts).
 
 check_only(Schema, Map, Opts) ->
-    _ = hocon_schema:check_plain(Schema, Map, Opts),
+    _ = hocon_tconf:check_plain(Schema, Map, Opts),
     Map.
 
 support_check_schema(#{check_schema := true, translate_body := true}) ->
@@ -199,12 +199,12 @@ check_parameter([{Name, Type} | Spec], Bindings, QueryStr, Module, BindingsAcc,
     case hocon_schema:field_schema(Type, in) of
         path ->
             Option = #{atom_key => true},
-            NewBindings = hocon_schema:check_plain(Schema, Bindings, Option),
+            NewBindings = hocon_tconf:check_plain(Schema, Bindings, Option),
             NewBindingsAcc = maps:merge(BindingsAcc, NewBindings),
             check_parameter(Spec, Bindings, QueryStr, Module, NewBindingsAcc, QueryStrAcc);
         query ->
             Option = #{},
-            NewQueryStr = hocon_schema:check_plain(Schema, QueryStr, Option),
+            NewQueryStr = hocon_tconf:check_plain(Schema, QueryStr, Option),
             NewQueryStrAcc = maps:merge(QueryStrAcc, NewQueryStr),
             check_parameter(Spec, Bindings, QueryStr, Module,BindingsAcc, NewQueryStrAcc)
     end.
diff --git a/apps/emqx_plugins/src/emqx_plugins.erl b/apps/emqx_plugins/src/emqx_plugins.erl
index 9a81b1296..2daad2e71 100644
--- a/apps/emqx_plugins/src/emqx_plugins.erl
+++ b/apps/emqx_plugins/src/emqx_plugins.erl
@@ -322,7 +322,7 @@ do_read_plugin({file, InfoFile}) ->
     [_, NameVsn | _] = lists:reverse(filename:split(InfoFile)),
     case hocon:load(InfoFile, #{format => richmap}) of
         {ok, RichMap} ->
-            Info = check_plugin(hocon_util:richmap_to_map(RichMap), NameVsn, InfoFile),
+            Info = check_plugin(hocon_maps:ensure_plain(RichMap), NameVsn, InfoFile),
             maps:merge(Info, plugin_status(NameVsn));
         {error, Reason} ->
             throw(#{error => "bad_info_file",
diff --git a/apps/emqx_resource/include/emqx_resource_utils.hrl b/apps/emqx_resource/include/emqx_resource_utils.hrl
index 77bd7cceb..8d13036ce 100644
--- a/apps/emqx_resource/include/emqx_resource_utils.hrl
+++ b/apps/emqx_resource/include/emqx_resource_utils.hrl
@@ -15,7 +15,7 @@
 %%--------------------------------------------------------------------
 
 -define(SAFE_CALL(_EXP_),
-        ?SAFE_CALL(_EXP_, _ = do_nothing)).
+        ?SAFE_CALL(_EXP_, ok)).
 
 -define(SAFE_CALL(_EXP_, _EXP_ON_FAIL_),
         fun() ->
diff --git a/apps/emqx_resource/src/emqx_resource.erl b/apps/emqx_resource/src/emqx_resource.erl
index 1f14e527d..e42857303 100644
--- a/apps/emqx_resource/src/emqx_resource.erl
+++ b/apps/emqx_resource/src/emqx_resource.erl
@@ -297,14 +297,14 @@ call_jsonify(Mod, Config) ->
 check_config(ResourceType, RawConfig) when is_binary(RawConfig) ->
     case hocon:binary(RawConfig, #{format => richmap}) of
         {ok, MapConfig} ->
-            case ?SAFE_CALL(hocon_schema:check(ResourceType, MapConfig, ?HOCON_CHECK_OPTS)) of
+            case ?SAFE_CALL(hocon_tconf:check(ResourceType, MapConfig, ?HOCON_CHECK_OPTS)) of
                 {error, Reason} -> {error, Reason};
-                Config -> {ok, hocon_schema:richmap_to_map(Config)}
+                Config -> {ok, hocon_maps:ensure_plain(Config)}
             end;
         Error -> Error
     end;
 check_config(ResourceType, RawConfigTerm) ->
-    case ?SAFE_CALL(hocon_schema:check_plain(ResourceType, RawConfigTerm, ?HOCON_CHECK_OPTS)) of
+    case ?SAFE_CALL(hocon_tconf:check_plain(ResourceType, RawConfigTerm, ?HOCON_CHECK_OPTS)) of
         {error, Reason} -> {error, Reason};
         Config -> {ok, Config}
     end.
diff --git a/apps/emqx_rule_engine/src/emqx_rule_api_schema.erl b/apps/emqx_rule_engine/src/emqx_rule_api_schema.erl
index 7af10a342..ead54cbe3 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_api_schema.erl
+++ b/apps/emqx_rule_engine/src/emqx_rule_api_schema.erl
@@ -15,7 +15,7 @@
 -spec check_params(map(), tag()) -> {ok, map()} | {error, term()}.
 check_params(Params, Tag) ->
     BTag = atom_to_binary(Tag),
-    try hocon_schema:check_plain(?MODULE, #{BTag => Params},
+    try hocon_tconf:check_plain(?MODULE, #{BTag => Params},
             #{atom_key => true, nullable => true}, [BTag]) of
         #{Tag := Checked} -> {ok, Checked}
     catch