{"record":{"id":"21426e8e3a20487d","repo":"thephpleague/oauth2-server","slug":"invalid-request-21426e","errorCode":"invalid_request","errorMessage":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"client_id\" parameter","messagePattern":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed\\. Check the \"client_id\" parameter","errorType":"http","errorClass":"OAuthServerException","httpStatus":400,"severity":"error","filePath":"src/Grant/DeviceCodeGrant.php","lineNumber":86,"sourceCode":"     */\n    public function canRespondToDeviceAuthorizationRequest(ServerRequestInterface $request): bool\n    {\n        return true;\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function respondToDeviceAuthorizationRequest(ServerRequestInterface $request): DeviceCodeResponse\n    {\n        $clientId = $this->getRequestParameter(\n            'client_id',\n            $request,\n            $this->getServerParameter('PHP_AUTH_USER', $request)\n        );\n\n        if ($clientId === null) {\n            throw OAuthServerException::invalidRequest('client_id');\n        }\n\n        $client = $this->getClientEntityOrFail($clientId, $request);\n\n        $scopes = $this->validateScopes($this->getRequestParameter('scope', $request, $this->defaultScope));\n\n        $deviceCodeEntity = $this->issueDeviceCode(\n            $this->deviceCodeTTL,\n            $client,\n            $this->verificationUri,\n            $scopes\n        );\n\n        $response = new DeviceCodeResponse();\n\n        if ($this->includeVerificationUriComplete === true) {\n            $response->includeVerificationUriComplete();\n        }","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/Grant/DeviceCodeGrant.php#L68-L104","documentation":"The device authorization request carried no client_id parameter, so DeviceCodeGrant cannot identify which client is requesting a device code. invalidRequest('client_id') produces this RFC6749-style invalid_request message naming the missing parameter.","triggerScenarios":"POSTing to the device authorization endpoint without a client_id parameter and without PHP_AUTH_USER (HTTP Basic) set; resolving $clientId via getRequestParameter('client_id') falling back to getServerParameter('PHP_AUTH_USER') and both being null.","commonSituations":"Consumer forgot the client_id field in the form body; requests sent as JSON instead of application/x-www-form-urlencoded so the PSR-7 parsed body is empty; a reverse proxy strips the Authorization Basic header the client relied on; tests hitting the endpoint with no params at all.","solutions":["Include client_id in the POSTed form body of the device authorization request","Or send HTTP Basic auth with the client id as username so PHP_AUTH_USER is populated","Ensure the request Content-Type is application/x-www-form-urlencoded so $request->getParsedBody() is populated","Verify the client_id value matches a registered client before calling, since the next step getClientEntityOrFail will also fail on an unknown id"],"exampleFix":"// before\ncurl -X POST https://auth.example.com/device/code\n\n// after\ncurl -X POST https://auth.example.com/device/code -d 'client_id=my-device-app&scope=basic'","handlingStrategy":"validation","validationCode":"$params = (array) $request->getParsedBody(); if (empty($params['client_id']) && empty($request->getServerParams()['PHP_AUTH_USER'])) { return errorResponse('client_id is required'); }","typeGuard":null,"tryCatchPattern":"try { $deviceAuth = $grant->respondToDeviceAuthorizationRequest($request, $response); } catch (OAuthServerException $e) { if (str_contains($e->getMessage(), 'client_id')) { return 400 with hint to send client_id; } throw $e; }","preventionTips":["POST as application/x-www-form-urlencoded with client_id present","Prefer explicit body client_id over relying on Basic-auth PHP_AUTH_USER","Validate client_id against registered clients before dispatching to the grant","Check proxies don't strip Authorization headers if relying on Basic auth"],"tags":["oauth2","device-flow","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}