{"record":{"id":"1c61019b4177e682","repo":"RocketChat/Rocket.Chat","slug":"server-error","errorCode":"server_error","errorMessage":"Invalid clientId","messagePattern":"Invalid clientId","errorType":"exception","errorClass":"Error","httpStatus":503,"severity":"error","filePath":"apps/meteor/server/oauth2-server/model.ts","lineNumber":85,"sourceCode":"\t\t};\n\n\t\treturn result;\n\t}\n\n\tasync getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {\n\t\tif (this.debug === true) {\n\t\t\tconsole.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');\n\t\t}\n\n\t\tlet client;\n\t\tif (clientSecret == null) {\n\t\t\tclient = await OAuthApps.findOneActiveByClientId(clientId);\n\t\t} else {\n\t\t\tclient = await OAuthApps.findOneActiveByClientIdAndClientSecret(clientId, clientSecret);\n\t\t}\n\n\t\tif (!client) {\n\t\t\tthrow new Error('Invalid clientId');\n\t\t}\n\n\t\tconst result: Client = {\n\t\t\tgrants: this.grants,\n\t\t\tredirectUris: client.redirectUri.split(','),\n\t\t\tid: client.clientId,\n\t\t};\n\n\t\treturn result;\n\t}\n\n\tasync getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {\n\t\tif (this.debug === true) {\n\t\t\tconsole.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);\n\t\t}\n\n\t\tconst code = await OAuthAuthCodes.findOneByAuthCode(authorizationCode);\n\t\tif (!code) {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/oauth2-server/model.ts#L67-L103","documentation":"Part of Rocket.Chat's OAuth2 provider: Model.getClient() runs on every authorize and token request, looking the app up via OAuthApps.findOneActiveByClientId (or findOneActiveByClientIdAndClientSecret when a secret is supplied). A miss throws plain 'Invalid clientId', which surfaces to OAuth clients as a server error because it is not one of oauth2-server's typed grant errors.","triggerScenarios":"An OAuth authorize or token request whose client_id — or client_id+client_secret pair on token requests — matches no active document in the OAuthApps collection: unknown clientId, wrong secret, or an app that was deleted or deactivated.","commonSituations":"Wrong credentials pasted into the relying party; the OAuth app was removed from Administration > OAuth Apps after the integration went live; staging credentials used against production or vice versa.","solutions":["Re-copy clientId/clientSecret from Administration > OAuth Apps and confirm the app is listed and Active","If the app was deleted or deactivated, recreate/reactivate it and update the relying party","For confidential clients, ensure client_secret is sent on token requests","Verify environment pairing (staging vs production hostnames and app records)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const looksLikeClientId = (v: unknown): boolean =>\n  typeof v === 'string' && v.length > 0 && /^[a-zA-Z0-9-_]+$/.test(v);","typeGuard":null,"tryCatchPattern":"try {\n  await oauthServer.token(request); // or authorize()\n} catch (error) {\n  if (error instanceof Error && /Invalid clientId/.test(error.message)) {\n    // clientId/secret no longer match an active OAuth app; re-provision credentials\n    await reloadOAuthAppCredentials();\n  } else {\n    throw error;\n  }\n}","preventionTips":["Store clientId/clientSecret per environment and never mix staging with production","Alert when OAuth apps are deleted or deactivated while integrations reference them","Smoke-test the authorize+token pair after any admin change to OAuth Apps"],"tags":["oauth2","oauth-apps","authentication","rocket-chat-server"],"backgroundTag":"invalid-oauth-client-id","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}