{"record":{"id":"2077b848777d02e0","repo":"PrefectHQ/fastmcp","slug":"missing-required-client-id","errorCode":null,"errorMessage":"Missing required client id","messagePattern":"Missing required client id","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oidc_proxy.py","lineNumber":353,"sourceCode":"                on every request, so a longer FastMCP lifetime does not extend upstream\n                access — a revoked or expired upstream session still fails validation. Set\n                this for bridges whose upstream issues short-lived access tokens that some\n                MCP clients can't refresh gracefully (e.g. `mcp-remote`).\n            token_expiry_threshold_seconds: Number of seconds before actual expiry to consider\n                a token as expired (default 0). Prevents race conditions where a token\n                passes the expiry check but expires before the next operation completes.\n            enable_cimd: Whether to enable CIMD (Client ID Metadata Document) client support.\n                When True, clients can use their metadata document URL as client_id instead of\n                Dynamic Client Registration. Default is True.\n            identity_assertion: Optional SEP-990 identity assertion (ID-JAG) configuration.\n                When provided, the token endpoint accepts the RFC 7523 jwt-bearer grant\n                carrying an ID-JAG issued by one of the configured trusted issuers.\n        \"\"\"\n        if not config_url:\n            raise ValueError(\"Missing required config URL\")\n\n        if not client_id:\n            raise ValueError(\"Missing required client id\")\n\n        if not client_secret and not jwt_signing_key:\n            raise ValueError(\n                \"Either client_secret or jwt_signing_key must be provided. \"\n                \"jwt_signing_key is required when client_secret is omitted \"\n                \"(e.g., for PKCE public clients).\"\n            )\n\n        if not base_url:\n            raise ValueError(\"Missing required base URL\")\n\n        # Validate that verifier-specific parameters are not used with custom verifier\n        if token_verifier is not None:\n            if algorithm is not None:\n                raise ValueError(\n                    \"Cannot specify 'algorithm' when providing a custom token_verifier. \"\n                    \"Configure the algorithm on your token verifier instead.\"\n                )","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oidc_proxy.py#L335-L371","documentation":"OIDCProxy requires a client_id (the client registered with the OIDC provider) and raises ValueError at construction when it is missing or empty. OAuth flows cannot identify the application to the provider without it.","triggerScenarios":"Constructing OIDCProxy(...) with client_id=None or \"\" — typically an unset environment variable or a config object that omitted the field.","commonSituations":"Deployed without the CLIENT_ID secret configured; secrets manager key renamed; local .env not loaded in the runtime environment.","solutions":["Register an OAuth client with your provider and pass its client_id to OIDCProxy","Ensure the env var/secret holding the client id is set in the deployment environment","Fail fast at startup with an explicit check before constructing the proxy"],"exampleFix":"// before\nproxy = OIDCProxy(config_url=..., client_id=os.getenv(\"CLIENT_ID\"))  # None\n// after\nclient_id = os.environ[\"OIDC_CLIENT_ID\"]\nproxy = OIDCProxy(config_url=..., client_id=client_id)","handlingStrategy":"validation","validationCode":"client_id = os.environ.get(\"OIDC_CLIENT_ID\")\nif not client_id:\n    raise ValueError(\"OIDC_CLIENT_ID env var is required\")","typeGuard":null,"tryCatchPattern":"try:\n    proxy = OIDCProxy(config_url=..., client_id=client_id, ...)\nexcept ValueError as e:\n    logger.error(\"OIDCProxy misconfigured: %s\", e)\n    raise SystemExit(1)","preventionTips":["Register the client with your provider before deploying","Verify secrets are mounted/loaded in the deployment environment","Use a settings class that validates required fields at import/startup time"],"tags":["oidc","configuration","missing-parameter"],"backgroundTag":"missing-required-parameter","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}