Budibase/budibase · error · Error

Microsoft OAuth callback is missing the authorization code

Error message

Microsoft OAuth callback is missing the authorization code

What it means

After a non-error callback, the controller requires an authorization `code` query parameter to exchange for tokens. If it is absent (after state and error checks pass), this Error is thrown.

Source

Thrown at packages/server/src/api/controllers/ai/sharepointAuth.ts:126

  ) {
    throw new Error("Microsoft OAuth state is invalid or expired")
  }
  const appId = stateAppId

  const oauthError = String(ctx.query.error || "").trim()
  if (oauthError) {
    const description = String(ctx.query.error_description || "").trim()
    console.error("Microsoft OAuth authorization failed", {
      appId,
      error: oauthError,
      hasDescription: !!description,
    })
    throw new Error("Microsoft OAuth authorization failed")
  }

  const code = String(ctx.query.code || "").trim()
  if (!code) {
    throw new Error(
      "Microsoft OAuth callback is missing the authorization code"
    )
  }

  const { clientId, clientSecret, tenantId } = getMicrosoftConfig()
  const platformUrl = await configs.getPlatformUrl({ tenantAware: false })
  const callbackUrl = `${platformUrl}/api/agent/knowledge-sources/sharepoint/callback`
  const tokenEndpoint = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`

  const tokenResponse = await fetch(tokenEndpoint, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: new URLSearchParams({
      client_id: clientId,
      client_secret: clientSecret,
      grant_type: "authorization_code",

View on GitHub (pinned to a81a902e9a)

Solutions

1. Ensure the auth request uses response_mode=query (or the default) so the code arrives in the URL query string.
2. Verify the Azure AD redirect URI and platform config allow a standard authorization-code flow.
3. Restart the flow via the start endpoint rather than hitting the callback URL directly.

Example fix

// before
const authUrl = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize?...&response_mode=fragment`
// after
const authUrl = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize?...&response_mode=query&response_type=code`

const params = new URL(callbackUrl).searchParams
if (!params.get('code')) throw new Error('callback URL must include the authorization code')

try {
  await completeSharePointAuth(ctx)
} catch (e) {
  if (e.message === 'Microsoft OAuth callback is missing the authorization code') {
    // restart the flow with response_mode=query
  } else throw e
}

When it happens

Trigger: Microsoft redirects to the callback without a code (e.g. response_mode mismatch or silent failure), or the callback endpoint is invoked manually without ?code=.

Common situations: response_mode configured as fragment while the callback reads query params; Azure AD app config issues causing redirect without code; hand-crafted callback URLs in testing.

Related errors

• Microsoft OAuth callback is missing state
• No Microsoft datasource configuration found
• Microsoft OAuth state is invalid or expired
• Microsoft OAuth authorization failed
• Failed to exchange Microsoft OAuth code

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/5f1c3f4e2002966c. Report an issue: GitHub.