{"record":{"id":"164c5d991201e50c","repo":"calcom/cal.diy","slug":"permissionsguard-no-oauth-client-found-for-clien","errorCode":null,"errorMessage":"PermissionsGuard - no oAuth client found for client id=${id}","messagePattern":"PermissionsGuard - no oAuth client found for client id=(.+?)","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.ts","lineNumber":89,"sourceCode":"    return true;\n  }\n\n  async getOAuthClientByAccessToken(\n    accessToken: string\n  ): Promise<Pick<PlatformOAuthClient, \"id\" | \"permissions\">> {\n    const oAuthClient = await this.tokensRepository.getAccessTokenClient(accessToken);\n    if (!oAuthClient) {\n      throw new ForbiddenException(\n        `PermissionsGuard - no oAuth client found for access token=${accessToken}`\n      );\n    }\n    return oAuthClient;\n  }\n\n  async getOAuthClientById(id: string): Promise<Pick<PlatformOAuthClient, \"id\" | \"permissions\">> {\n    const oAuthClient = await this.oAuthClientRepository.getOAuthClient(id);\n    if (!oAuthClient) {\n      throw new ForbiddenException(`PermissionsGuard - no oAuth client found for client id=${id}`);\n    }\n    return oAuthClient;\n  }\n\n  getDecodedThirdPartyAccessToken(bearerToken: string) {\n    return this.tokensService.getDecodedThirdPartyAccessToken(bearerToken);\n  }\n}\n","sourceCodeStart":71,"sourceCodeEnd":98,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/guards/permissions/permissions.guard.ts#L71-L98","documentation":"ForbiddenException from PermissionsGuard.getOAuthClientById when oAuthClientRepository.getOAuthClient(id) returns null — the x-cal-client-id header (or clientId route param) does not correspond to any platform OAuth client in the database.","triggerScenarios":"Calling a PermissionsGuard-protected endpoint with an x-cal-client-id header (or :clientId route param) whose value is not a valid platform OAuth client id — wrong, deleted, typo, or from a different environment.","commonSituations":"Client id copied from a different environment (staging vs production); OAuth client was deleted/deactivated; header typo or extra whitespace; mixing the public client_id with the internal database id.","solutions":["Verify the x-cal-client-id value matches a client listed in the platform dashboard for THIS environment.","Strip any whitespace/newlines from the header value.","If the client was deleted, create a new OAuth client and update the integration.","Confirm you are sending client_id (the public id), not the secret or the DB id."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!clientId || typeof clientId !== 'string' || clientId.trim().length === 0) {\n  throw new Error('x-cal-client-id header must be a non-empty string');\n}","typeGuard":"function isValidClientId(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0 && !/[\\r\\n]/.test(v);\n}","tryCatchPattern":null,"preventionTips":["Copy the client_id exactly from the dashboard for the target environment.","Strip whitespace/newlines from header values.","Use the public client_id, never the secret or DB id."],"tags":["auth","oauth","client-id","guard","config"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}