{"record":{"id":"53719bce6a5132ec","repo":"usebruno/bruno","slug":"password-is-required-for-oauth2-password-credentia","errorCode":null,"errorMessage":"Password is required for OAuth2 password credentials flow","messagePattern":"Password is required for OAuth2 password credentials flow","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/bruno-requests/src/auth/oauth2-helper.ts","lineNumber":223,"sourceCode":"    clientId,\n    clientSecret,\n    username,\n    password,\n    scope,\n    credentialsPlacement = 'basic_auth_header',\n    additionalParameters\n  } = oauth2Config;\n\n  if (!accessTokenUrl) {\n    throw new Error('Access Token URL is required for OAuth2 password credentials flow');\n  }\n\n  if (!username) {\n    throw new Error('Username is required for OAuth2 password credentials flow');\n  }\n\n  if (!password) {\n    throw new Error('Password is required for OAuth2 password credentials flow');\n  }\n\n  if (!clientId) {\n    throw new Error('Client ID is required for OAuth2 password credentials flow');\n  }\n\n  const requestConfig: RequestConfig = {\n    method: 'POST',\n    url: accessTokenUrl,\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'Accept': 'application/json'\n    },\n    data: '',\n    responseType: 'arraybuffer'\n  };\n\n  const data: PasswordGrantData = {","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-requests/src/auth/oauth2-helper.ts#L205-L241","documentation":"Thrown by fetchTokenPassword when oauth2Config.password is falsy. The resource-owner password grant requires the user's password to exchange for a token; the helper rejects the call up front rather than sending a malformed request.","triggerScenarios":"getOAuth2AccessToken called with grantType='password' and a username, but the password field empty/undefined.","commonSituations":"Password field left blank in a login flow; secret loader returned undefined for the password; password was accidentally trimmed/emptied by input sanitization.","solutions":["Ensure a non-empty password is supplied in the config.","Check the secret source (env var, keychain, prompt) actually returned a value.","Consider migrating away from the password grant — OAuth2.1 deprecates it; use authorization_code or client_credentials instead."],"exampleFix":"// before\nconst config = { grantType: 'password', accessTokenUrl: url, username: user, clientId: id };\n\n// after\nconst config = {\n  grantType: 'password',\n  accessTokenUrl: url,\n  username: user,\n  password: process.env.USER_PASSWORD,\n  clientId: id\n};","handlingStrategy":"validation","validationCode":"if (!config.password) throw new Error('Password required for password grant');","typeGuard":"function hasPassword(c) { return typeof c.password === 'string' && c.password.length > 0; }","tryCatchPattern":"try { await getOAuth2AccessToken(config, tokenStore); }\ncatch (e) { if (e.message.includes('Password is required')) { /* re-prompt */ } else throw e; }","preventionTips":["Never log or echo the password while validating its presence.","Prefer migrating to authorization_code flow; the password grant is deprecated in OAuth2.1.","Source the password from a secure prompt or secret manager, not a plain config file."],"tags":["oauth2","validation","configuration","password-grant","secrets"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}