RocketChat/Rocket.Chat · error · Error

server_error

server_error

Error message

Invalid clientId

What it means

Part of Rocket.Chat's OAuth2 provider: Model.getClient() runs on every authorize and token request, looking the app up via OAuthApps.findOneActiveByClientId (or findOneActiveByClientIdAndClientSecret when a secret is supplied). A miss throws plain 'Invalid clientId', which surfaces to OAuth clients as a server error because it is not one of oauth2-server's typed grant errors.

Source

Thrown at apps/meteor/server/oauth2-server/model.ts:85

		};

		return result;
	}

	async getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {
		if (this.debug === true) {
			console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');
		}

		let client;
		if (clientSecret == null) {
			client = await OAuthApps.findOneActiveByClientId(clientId);
		} else {
			client = await OAuthApps.findOneActiveByClientIdAndClientSecret(clientId, clientSecret);
		}

		if (!client) {
			throw new Error('Invalid clientId');
		}

		const result: Client = {
			grants: this.grants,
			redirectUris: client.redirectUri.split(','),
			id: client.clientId,
		};

		return result;
	}

	async getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {
		if (this.debug === true) {
			console.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);
		}

		const code = await OAuthAuthCodes.findOneByAuthCode(authorizationCode);
		if (!code) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Re-copy clientId/clientSecret from Administration > OAuth Apps and confirm the app is listed and Active
2. If the app was deleted or deactivated, recreate/reactivate it and update the relying party
3. For confidential clients, ensure client_secret is sent on token requests
4. Verify environment pairing (staging vs production hostnames and app records)

const looksLikeClientId = (v: unknown): boolean =>
  typeof v === 'string' && v.length > 0 && /^[a-zA-Z0-9-_]+$/.test(v);

try {
  await oauthServer.token(request); // or authorize()
} catch (error) {
  if (error instanceof Error && /Invalid clientId/.test(error.message)) {
    // clientId/secret no longer match an active OAuth app; re-provision credentials
    await reloadOAuthAppCredentials();
  } else {
    throw error;
  }
}

When it happens

Trigger: An OAuth authorize or token request whose client_id — or client_id+client_secret pair on token requests — matches no active document in the OAuthApps collection: unknown clientId, wrong secret, or an app that was deleted or deactivated.

Common situations: Wrong credentials pasted into the relying party; the OAuth app was removed from Administration > OAuth Apps after the integration went live; staging credentials used against production or vice versa.

Related errors

• error-invalid-user
• error-invalid-user
• Invalid Api parameter provided, it must be a valid IApi obje
• Invalid command parameter provided, must be a string.
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/1c61019b4177e682. Report an issue: GitHub.