{"record":{"id":"88aebb4717b82530","repo":"louislam/uptime-kuma","slug":"the-oauth-config-is-invalid-e-message-88aebb","errorCode":null,"errorMessage":"The oauth config is invalid. ${e.message}","messagePattern":"The oauth config is invalid\\. (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/monitor-types/globalping.js","lineNumber":537,"sourceCode":"                    monitor.oauth_token_url,\n                    monitor.oauth_client_id,\n                    monitor.oauth_client_secret,\n                    monitor.oauth_scopes,\n                    monitor.oauth_audience,\n                    monitor.oauth_auth_method\n                );\n                log.debug(\n                    \"monitor\",\n                    `[${monitor.name}] Obtained oauth access-token. Expires at ${new Date(oAuthAccessToken.expires_at * 1000)}`\n                );\n\n                monitor.oauthAccessToken = oAuthAccessToken;\n            }\n            return {\n                Authorization: monitor.oauthAccessToken.token_type + \" \" + monitor.oauthAccessToken.access_token,\n            };\n        } catch (e) {\n            throw new Error(\"The oauth config is invalid. \" + e.message);\n        }\n    }\n\n    /**\n     * Generates the basic authentication header for a monitor if it is enabled.\n     * @param {object} monitor - The monitor object.\n     * @returns {object} The basic authentication header.\n     */\n    getBasicAuthHeader(monitor) {\n        if (monitor.auth_method !== \"basic\") {\n            return {};\n        }\n\n        return {\n            Authorization: \"Basic \" + encodeBase64(monitor.basic_auth_user, monitor.basic_auth_pass),\n        };\n    }\n","sourceCodeStart":519,"sourceCodeEnd":555,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/monitor-types/globalping.js#L519-L555","documentation":"Thrown by getOauth2AuthHeader when auth_method === 'oauth2-cc' and the OAuth2 client-credentials token request fails for any reason. The original error message is appended so the root cause (bad URL, bad credentials, network) is visible. This fires before the HTTP measurement is even created, so the heartbeat fails at auth setup.","triggerScenarios":"monitor.auth_method === 'oauth2-cc' and getOidcTokenClientCredentials rejects: wrong oauth_token_url, invalid/missing oauth_client_id or oauth_client_secret, unsupported oauth_auth_method, bad/expired scopes, or a network failure reaching the IdP.","commonSituations":"OAuth client secret rotated but not updated in the monitor, token URL mistyped or not reachable, wrong grant/scope for the IdP, or the IdP rejecting the configured token endpoint auth method.","solutions":["Verify oauth_token_url is the correct token endpoint for your IdP","Confirm oauth_client_id and oauth_client_secret are current and not revoked","Check that oauth_scopes and oauth_audience match what the IdP allows","Ensure oauth_auth_method (client_secret_basic vs post) matches the IdP's registered client config"],"exampleFix":"// before: wrong token endpoint auth method for the registered client\nmonitor.oauth_auth_method = \"client_secret_post\";\n// after: match the IdP registration\nmonitor.oauth_auth_method = \"client_secret_basic\";","handlingStrategy":"validation","validationCode":"// Validate OAuth2 client-credentials config before the HTTP check\nif (monitor.auth_method === \"oauth2-cc\") {\n    for (const f of [\"oauth_token_url\", \"oauth_client_id\", \"oauth_client_secret\"]) {\n        if (!monitor[f]) throw new Error(\"Missing OAuth2 field: \" + f);\n    }\n    try { new URL(monitor.oauth_token_url); } catch {\n        throw new Error(\"oauth_token_url is not a valid URL\");\n    }\n}","typeGuard":null,"tryCatchPattern":"// Test the token fetch in isolation so the real error surfaces\ntry {\n    return { Authorization: monitor.oauthAccessToken.token_type + \" \" + monitor.oauthAccessToken.access_token };\n} catch (e) {\n    throw new Error(\"The oauth config is invalid. \" + e.message);\n}","preventionTips":["Keep client secrets in a secret store and rotate before expiry","Confirm the token endpoint URL and auth method match the IdP client registration","Verify scopes/audience are permitted by the IdP"],"tags":["globalping","oauth2","auth","config"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}