Budibase/budibase · error

Configuration invalid. Must contain google clientID and clie

Error message

Configuration invalid. Must contain google clientID and clientSecret

What it means

strategyFactory builds a passport GoogleStrategy for SSO login and throws when the supplied config lacks a clientID or clientSecret. A valid Google OAuth client (both values from Google Cloud Console) is required to construct the strategy.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/google.ts:57

    )
  }
}

/**
 * Create an instance of the google passport strategy. This wrapper fetches the configuration
 * from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport.
 * @returns Dynamically configured Passport Google Strategy
 */
export async function strategyFactory(
  config: GoogleInnerConfig,
  callbackUrl: string,
  saveUserFn: SaveSSOUserFunction
) {
  try {
    const { clientID, clientSecret } = config

    if (!clientID || !clientSecret) {
      throw new Error(
        "Configuration invalid. Must contain google clientID and clientSecret"
      )
    }

    const verify = buildVerifyFn(saveUserFn)
    return new GoogleStrategy(
      {
        clientID: config.clientID,
        clientSecret: config.clientSecret,
        callbackURL: callbackUrl,
      },
      verify
    )
  } catch (err: any) {
    throw new Error(`Error constructing google authentication strategy: ${err}`)
  }
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Re-save Google SSO config with both clientID and clientSecret from Google Cloud Console
2. Reset the client secret in Google Cloud Console if lost, then update the config
3. Validate the config payload before saving (both fields non-empty strings)
4. Check the config document in the DB actually contains both keys (not just placeholders)

Example fix

// before
await config.save({ type: ConfigType.GOOGLE, config: { clientID } })
// after
await config.save({ type: ConfigType.GOOGLE, config: { clientID, clientSecret: process.env.GOOGLE_CLIENT_SECRET } })

const { clientID, clientSecret } = config
if (!clientID || !clientSecret) {
  throw new Error("Google SSO requires both clientID and clientSecret")
}

function isGoogleSsoConfig(c: unknown): c is { clientID: string; clientSecret: string } {
  const cfg = c as { clientID?: string; clientSecret?: string }
  return typeof cfg.clientID === "string" && cfg.clientID.length > 0 &&
         typeof cfg.clientSecret === "string" && cfg.clientSecret.length > 0
}

When it happens

Trigger: Configuring Google SSO with only one of clientID/clientSecret, saving empty strings, or a corrupted/partial config document passed to strategyFactory during login.

Common situations: Admin saved the Google SSO form with a missing secret; Google Cloud OAuth client deleted/disabled so the secret was cleared; copying the clientID into the secret field; config created via API with omitted fields.

Related errors

• No google configuration found
• Unable to fetch datasource auth cookie
• Error constructing google authentication strategy: ${err}
• Configuration invalid. Must contain clientID, clientSecret,
• Password change is disabled for this user

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/9227392bb5d9c7da. Report an issue: GitHub.