{"record":{"id":"505f2b6c3e43ce46","repo":"googleapis/mcp-toolbox","slug":"client-id-or-client-secret-not-valid","errorCode":null,"errorMessage":"client id or client secret not valid","messagePattern":"client id or client secret not valid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/looker/looker.go","lineNumber":278,"sourceCode":"\t\t\tTLSClientConfig: &tls.Config{\n\t\t\t\tInsecureSkipVerify: !s.LookerApiSettings().VerifySsl,\n\t\t\t},\n\t\t}\n\n\t\t// Build transport for end user token\n\t\tsession.Client = http.Client{\n\t\t\tTransport: &transportWithAuthHeader{\n\t\t\t\tBase:      transport,\n\t\t\t\tAuthToken: accessToken,\n\t\t\t\tclientIP:  clientIP,\n\t\t\t},\n\t\t}\n\t\t// return SDK with new Transport\n\t\treturn v4.NewLookerSDK(session), nil\n\t}\n\n\tif s.LookerClient() == nil {\n\t\treturn nil, fmt.Errorf(\"client id or client secret not valid\")\n\t}\n\treturn s.LookerClient(), nil\n}\n\nfunc initGoogleCloudConnection(ctx context.Context) (oauth2.TokenSource, error) {\n\tcred, err := google.FindDefaultCredentials(ctx, geminidataanalytics.DefaultAuthScopes()...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to find default Google Cloud credentials with scope %q: %w\", geminidataanalytics.DefaultAuthScopes(), err)\n\t}\n\n\treturn cred.TokenSource, nil\n}\n\nfunc (s *Source) GetHostURL(ctx context.Context, sdk *v4.LookerSDK) (string, error) {\n\tdefaultURL := strings.TrimSuffix(s.ApiSettings.BaseUrl, \"/\")\n\n\tif sdk == nil {\n\t\treturn defaultURL, nil","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/looker/looker.go#L260-L296","documentation":"GetLookerSDK returns the configured Looker SDK client, but if the Source's LookerClient was never initialized (because client id/secret credentials were missing or invalid during Initialize), it fails with this message. It guards against returning a nil SDK that would panic downstream. The check `s.LookerClient() == nil` means the API3 credentials supplied to Looker did not yield a usable client.","triggerScenarios":"Calling GetLookerSDK on a Source whose client id or client secret was empty/invalid at Initialize time, so the lookersdk session was never built and LookerClient() returns nil.","commonSituations":"Environment variables or YAML config missing client_id/client_secret; credentials typed incorrectly; using API credentials that were disabled or deleted in the Looker admin console.","solutions":["Set valid client_id and client_secret (Looker API3 credentials) in the source config or environment and re-initialize the toolbox","Generate new API3 credentials in Looker under Admin > Users > API keys and use those values","Verify the credentials are enabled and belong to an active Looker user with required permissions"],"exampleFix":"// before\ns.LookerClient() == nil // \"client id or client secret not valid\"\n// after\n// config yaml:\n// client_id: ${LOOKER_CLIENT_ID}\n// client_secret: ${LOOKER_CLIENT_SECRET}\nexport LOOKER_CLIENT_ID=abc123\nexport LOOKER_CLIENT_SECRET=xyz789","handlingStrategy":"validation","validationCode":"if os.Getenv(\"LOOKER_CLIENT_ID\") == \"\" || os.Getenv(\"LOOKER_CLIENT_SECRET\") == \"\" {\n    return fmt.Errorf(\"LOOKER_CLIENT_ID and LOOKER_CLIENT_SECRET must be set\")\n}","typeGuard":"if client := src.LookerClient(); client == nil {\n    return fmt.Errorf(\"looker client not initialized; check client id/secret\")\n}","tryCatchPattern":"sdk, err := src.GetLookerSDK(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"client id or client secret not valid\") {\n        // re-load credentials and re-initialize source\n    }\n    return err\n}","preventionTips":["Load client id/secret from a secret manager instead of ad-hoc env vars","Validate credentials by calling a cheap Looker API (e.g. /versions) at startup","Rotate API3 keys before they are disabled in Looker"],"tags":["looker","authentication","credentials","config"],"backgroundTag":"missing-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}