{"record":{"id":"2f3cb22a72ce19cc","repo":"multica-ai/multica","slug":"dingtalk-could-not-validate-credentials","errorCode":null,"errorMessage":"dingtalk: could not validate credentials","messagePattern":"dingtalk: could not validate credentials","errorType":"http","errorClass":"ErrCredentialValidation","httpStatus":400,"severity":"error","filePath":"server/internal/integrations/dingtalk/byo_install.go","lineNumber":26,"sourceCode":"\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/jackc/pgx/v5/pgtype\"\n\n\tdb \"github.com/multica-ai/multica/server/pkg/db/generated\"\n)\n\n// ErrInvalidAppKey / ErrInvalidAppSecret are returned by RegisterBYO when a\n// pasted credential is empty. The handler maps them to 400 so the dialog can\n// show a precise hint instead of a generic failure.\nvar (\n\tErrInvalidAppKey    = errors.New(\"dingtalk: AppKey (client id) is required\")\n\tErrInvalidAppSecret = errors.New(\"dingtalk: AppSecret (client secret) is required\")\n\t// ErrCredentialValidation wraps a live access-token mint that rejected the\n\t// pasted AppKey/AppSecret. It is a user error (bad credentials), so the\n\t// handler maps it to 400 — unlike an internal encrypt/persist failure, which\n\t// must surface as 500.\n\tErrCredentialValidation = errors.New(\"dingtalk: could not validate credentials\")\n)\n\n// RegisterBYOParams are the inputs for a bring-your-own-app install: the agent\n// this bot represents, who is installing, and the two credentials the user\n// pasted from their own DingTalk Stream-mode robot.\ntype RegisterBYOParams struct {\n\tWorkspaceID pgtype.UUID\n\tAgentID     pgtype.UUID\n\tInitiatorID pgtype.UUID\n\tAppKey      string // client id — robotCode + access-token mint\n\tAppSecret   string // client secret — access-token mint (encrypted at rest)\n}\n\n// RegisterBYO installs a user-supplied (\"bring your own\") DingTalk robot for an\n// default agent. The user creates their own DingTalk Stream-mode robot and pastes its\n// AppKey (client id) + AppSecret (client secret). There is NO OAuth code\n// exchange: we validate the credentials live by minting an access_token (which\n// proves the AppKey/AppSecret pair is valid), encrypt the AppSecret at rest, and","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/integrations/dingtalk/byo_install.go#L8-L44","documentation":"Error \"dingtalk: could not validate credentials\" thrown in multica-ai/multica.","triggerScenarios":"Thrown at server/internal/integrations/dingtalk/byo_install.go:26 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the DingTalk AppKey and AppSecret, then retry credential validation."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}