{"record":{"id":"0c4c90d6abe2d4f7","repo":"louislam/uptime-kuma","slug":"the-oauth-config-is-invalid-e-message","errorCode":null,"errorMessage":"The oauth config is invalid. ${e.message}","messagePattern":"The oauth config is invalid\\. (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/model/monitor.js","lineNumber":509,"sourceCode":"                    }\n\n                    // OIDC: Basic client credential flow.\n                    // Additional grants might be implemented in the future\n                    let oauth2AuthHeader = {};\n                    if (this.auth_method === \"oauth2-cc\") {\n                        try {\n                            if (\n                                this.oauthAccessToken === undefined ||\n                                new Date(this.oauthAccessToken.expires_at * 1000) <= new Date()\n                            ) {\n                                this.oauthAccessToken = await this.makeOidcTokenClientCredentialsRequest();\n                            }\n                            oauth2AuthHeader = {\n                                Authorization:\n                                    this.oauthAccessToken.token_type + \" \" + this.oauthAccessToken.access_token,\n                            };\n                        } catch (e) {\n                            throw new Error(\"The oauth config is invalid. \" + e.message);\n                        }\n                    }\n\n                    let agentFamily = undefined;\n                    if (this.ipFamily === \"ipv4\") {\n                        agentFamily = 4;\n                    }\n                    if (this.ipFamily === \"ipv6\") {\n                        agentFamily = 6;\n                    }\n\n                    const httpsAgentOptions = {\n                        maxCachedSessions: 0, // Use Custom agent to disable session reuse (https://github.com/nodejs/node/issues/3940)\n                        rejectUnauthorized: !this.getIgnoreTls(),\n                        secureOptions: crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT,\n                        autoSelectFamily: true,\n                        ...(agentFamily ? { family: agentFamily } : {}),\n                    };","sourceCodeStart":491,"sourceCodeEnd":527,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/model/monitor.js#L491-L527","documentation":"During a poll of an HTTP/keyword/json-query monitor configured with auth_method === 'oauth2-cc', the monitor tries to obtain an OAuth2 access token via makeOidcTokenClientCredentialsRequest() (cached on this.oauthAccessToken). Any failure there — network error, non-2xx from the token endpoint, malformed token response, bad client credentials — is caught and re-thrown wrapped as 'The oauth config is invalid. <original message>'. This unified message surfaces as the monitor's bean.msg, so it is what you see in the UI.","triggerScenarios":"oauth2-cc monitor with a wrong token URL, wrong client_id/client_secret, a token endpoint that returns an error JSON (e.g. invalid_grant), an issuer that requires a scope you did not configure, a self-signed cert on the token endpoint blocked by rejectUnauthorized, or the IdP being unreachable from the Uptime Kuma host.","commonSituations":"Typo in the OIDC token URL; rotated client secret not updated in Uptime Kuma; IdP rate-limiting or returning 401; clock skew breaking token refresh; corporate proxy intercepting TLS to the IdP.","solutions":["Replay the token request with curl using the same client_id/secret and token_url to see the real error body: `curl -X POST <token_url> -u '<client_id>:<client_secret>' -d 'grant_type=client_credentials' -d 'scope=<scope>'`.","Verify the token URL, client_id, client_secret and scope fields on the monitor match what your IdP issued.","If the IdP uses a self-signed or internal CA, configure Uptime Kuma to trust it (the httpsAgentOptions uses rejectUnauthorized = !ignoreTls, so toggle 'Ignore TLS Error' on the monitor if appropriate).","Check network egress from the Uptime Kuma host to the IdP (DNS, proxy, firewall).","Inspect the underlying message appended after 'The oauth config is invalid.' — it carries the IdP's actual response (e.g. 'invalid_client')."],"exampleFix":"// before\ncatch (e) {\n    throw new Error(\"The oauth config is invalid. \" + e.message);\n}\n\n// after — preserve the wrapped error's status/code so the UI can react\n} catch (e) {\n    const err = new Error(\"The oauth config is invalid. \" + e.message);\n    err.cause = e;\n    err.status = e.response?.status;\n    throw err;\n}","handlingStrategy":"try-catch","validationCode":"// Validate the oauth2-cc config and probe the token endpoint before relying on it\nasync function probeOauth2CC({ tokenUrl, clientId, clientSecret, scope }) {\n    const body = new URLSearchParams({ grant_type: \"client_credentials\" });\n    if (scope) body.set(\"scope\", scope);\n    const res = await fetch(tokenUrl, {\n        method: \"POST\",\n        headers: { Authorization: \"Basic \" + Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\"), \"Content-Type\": \"application/x-www-form-urlencoded\" },\n        body\n    });\n    if (!res.ok) throw new Error(`IdP responded ${res.status}: ${await res.text()}`);\n    const json = await res.json();\n    if (!json.access_token) throw new Error(\"IdP returned no access_token\");\n    return json;\n}","typeGuard":"function isOauthConfigComplete(cfg) {\n    return Boolean(cfg && cfg.auth_method === \"oauth2-cc\" && cfg.oauth_token_url && cfg.oauth_client_id && cfg.oauth_client_secret);\n}","tryCatchPattern":"// Surface the wrapped IdP error to operators\ntry {\n    oauth2AuthHeader = /* ...makeOidcTokenClientCredentialsRequest() path... */;\n} catch (e) {\n    if (/oauth config is invalid/i.test(e.message)) {\n        bean.msg = e.message;        // shown in the monitor UI\n        bean.status = DOWN;\n        // optionally e.cause / e.status for richer handling\n    }\n}","preventionTips":["Test the token endpoint with curl using the same credentials before saving the monitor.","Rotate client secrets on a schedule and update monitors promptly.","Ensure egress from the Uptime Kuma host to the IdP is open (DNS, proxy, firewall).","If the IdP uses an internal CA, configure the trust store or enable 'Ignore TLS Error' deliberately."],"tags":["monitor","oauth2","oidc","http","auth"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}