{"record":{"id":"79f938a044fc3ea2","repo":"crewAIInc/crewAI","slug":"missing-required-fields-in-oauth2-configuration","errorCode":null,"errorMessage":"Missing required fields in OAuth2 configuration: [{', '.join(missing_basic_fields)}]","messagePattern":"Missing required fields in OAuth2 configuration: \\[(.+?)\\]","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/cli/src/crewai_cli/enterprise/main.py","lineNumber":111,"sourceCode":"        required_fields = [\n            \"audience\",\n            \"domain\",\n            \"device_authorization_client_id\",\n            \"provider\",\n            \"extra\",\n        ]\n\n        missing_basic_fields = [\n            field for field in required_fields if field not in oauth_config\n        ]\n        missing_provider_specific_fields = [\n            field\n            for field in self._get_provider_specific_fields(oauth_config[\"provider\"])\n            if field not in oauth_config.get(\"extra\", {})\n        ]\n\n        if missing_basic_fields:\n            raise ValueError(\n                f\"Missing required fields in OAuth2 configuration: [{', '.join(missing_basic_fields)}]\"\n            )\n\n        if missing_provider_specific_fields:\n            raise ValueError(\n                f\"Missing authentication provider required fields in OAuth2 configuration: [{', '.join(missing_provider_specific_fields)}] (Configured provider: '{oauth_config['provider']}')\"\n            )\n\n    def _get_provider_specific_fields(self, provider_name: str) -> list[str]:\n        provider = ProviderFactory.from_settings(\n            Oauth2Settings(provider=provider_name, client_id=\"dummy\", domain=\"dummy\")\n        )\n\n        return provider.get_required_fields()\n","sourceCodeStart":93,"sourceCodeEnd":126,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/cli/src/crewai_cli/enterprise/main.py#L93-L126","documentation":"Validation error from the enterprise OAuth2 discovery flow: the endpoint returned valid JSON, but the document is missing one or more of the required top-level fields — audience, domain, device_authorization_client_id, provider, extra. The message lists exactly which fields are absent. This is a server-side configuration problem, not a client input error.","triggerScenarios":"`crewai enterprise connect <url>` where the discovery endpoint's JSON omits required keys — e.g. an enterprise deployment that did not configure the device-authorization client, or a discovery document from a different/older product version using different field names.","commonSituations":"Enterprise server misconfiguration (OAuth provider not fully set up), version mismatch between the CLI's expected schema and the server's discovery document, or a hand-written/mock discovery endpoint missing keys.","solutions":["curl the discovery endpoint and diff the returned keys against: audience, domain, device_authorization_client_id, provider, extra","Have the enterprise admin complete the OAuth2 provider configuration so all fields are emitted","If keys exist under different names due to version skew, upgrade the CLI (or the server) so schemas match","Re-run `crewai enterprise connect` after the server-side fix"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"REQUIRED = {\"audience\", \"domain\", \"device_authorization_client_id\", \"provider\", \"extra\"}\n\ndef discovery_complete(doc: dict) -> bool:\n    return REQUIRED.issubset(doc)","typeGuard":"def is_complete_oauth_config(value: object) -> bool:\n    required = {\"audience\", \"domain\", \"device_authorization_client_id\", \"provider\", \"extra\"}\n    return isinstance(value, dict) and required.issubset(value)","tryCatchPattern":"try:\n    enterprise_cmd.connect(url)\nexcept ValueError as e:\n    if \"Missing required fields\" in str(e):\n        # server-side config gap; report the listed fields to the enterprise admin\n        ...","preventionTips":["curl the discovery endpoint and check all five required keys before onboarding","Have admins fully configure the OAuth provider before inviting CLI users","Pin CLI and server versions together in enterprise rollouts"],"tags":["enterprise","oauth","validation","configuration"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}