{"record":{"id":"5e05f8dddcdd9ea9","repo":"usebruno/bruno","slug":"username-is-required-for-oauth2-password-credentia","errorCode":null,"errorMessage":"Username is required for OAuth2 password credentials flow","messagePattern":"Username is required for OAuth2 password credentials flow","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/bruno-requests/src/auth/oauth2-helper.ts","lineNumber":219,"sourceCode":" */\nconst fetchTokenPassword = async (oauth2Config: OAuth2Config, axiosInstance?: AxiosInstance) => {\n  const {\n    accessTokenUrl,\n    clientId,\n    clientSecret,\n    username,\n    password,\n    scope,\n    credentialsPlacement = 'basic_auth_header',\n    additionalParameters\n  } = oauth2Config;\n\n  if (!accessTokenUrl) {\n    throw new Error('Access Token URL is required for OAuth2 password credentials flow');\n  }\n\n  if (!username) {\n    throw new Error('Username is required for OAuth2 password credentials flow');\n  }\n\n  if (!password) {\n    throw new Error('Password is required for OAuth2 password credentials flow');\n  }\n\n  if (!clientId) {\n    throw new Error('Client ID is required for OAuth2 password credentials flow');\n  }\n\n  const requestConfig: RequestConfig = {\n    method: 'POST',\n    url: accessTokenUrl,\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'Accept': 'application/json'\n    },\n    data: '',","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-requests/src/auth/oauth2-helper.ts#L201-L237","documentation":"Thrown by fetchTokenPassword when oauth2Config.username is falsy. The password grant exchanges the resource owner's credentials for a token, so a username is mandatory. The helper checks it before building the form body.","triggerScenarios":"getOAuth2AccessToken called with grantType='password', a valid accessTokenUrl, but no username supplied (empty string, null, or undefined).","commonSituations":"End-user login form submitted with an empty username; config loaded from a session where the user field was never populated; programmatic caller passed an object missing the username key.","solutions":["Pass a non-empty username in the OAuth2Config.","If the username comes from user input, validate the field is non-empty before triggering the token request.","Confirm the grant type is actually what you want — machine-to-machine calls should use client_credentials, not password."],"exampleFix":"// before\nconst config = { grantType: 'password', accessTokenUrl: url, password: pass, clientId: id };\n\n// after\nconst config = {\n  grantType: 'password',\n  accessTokenUrl: url,\n  username: formUsername,\n  password: pass,\n  clientId: id\n};","handlingStrategy":"validation","validationCode":"if (!config.username || !config.username.trim()) throw new Error('Username required for password grant');","typeGuard":"function hasUsername(c) { return typeof c.username === 'string' && c.username.trim().length > 0; }","tryCatchPattern":"try { await getOAuth2AccessToken(config, tokenStore); }\ncatch (e) { if (e.message.includes('Username is required')) { /* prompt user */ } else throw e; }","preventionTips":["Treat username as required form input with non-empty validation on the client.","Confirm grant type selection before requiring username — client_credentials does not need it."],"tags":["oauth2","validation","configuration","password-grant"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}