{"record":{"id":"96aaeec288d9e41f","repo":"PrefectHQ/fastmcp","slug":"missing-required-config-url","errorCode":null,"errorMessage":"Missing required config URL","messagePattern":"Missing required config URL","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oidc_proxy.py","lineNumber":350,"sourceCode":"                token (JWT), decoupling it from the upstream provider's `expires_in`. By\n                default (None) the FastMCP access token mirrors the upstream access token\n                lifetime. The FastMCP JWT is a reference token re-validated against upstream\n                on every request, so a longer FastMCP lifetime does not extend upstream\n                access — a revoked or expired upstream session still fails validation. Set\n                this for bridges whose upstream issues short-lived access tokens that some\n                MCP clients can't refresh gracefully (e.g. `mcp-remote`).\n            token_expiry_threshold_seconds: Number of seconds before actual expiry to consider\n                a token as expired (default 0). Prevents race conditions where a token\n                passes the expiry check but expires before the next operation completes.\n            enable_cimd: Whether to enable CIMD (Client ID Metadata Document) client support.\n                When True, clients can use their metadata document URL as client_id instead of\n                Dynamic Client Registration. Default is True.\n            identity_assertion: Optional SEP-990 identity assertion (ID-JAG) configuration.\n                When provided, the token endpoint accepts the RFC 7523 jwt-bearer grant\n                carrying an ID-JAG issued by one of the configured trusted issuers.\n        \"\"\"\n        if not config_url:\n            raise ValueError(\"Missing required config URL\")\n\n        if not client_id:\n            raise ValueError(\"Missing required client id\")\n\n        if not client_secret and not jwt_signing_key:\n            raise ValueError(\n                \"Either client_secret or jwt_signing_key must be provided. \"\n                \"jwt_signing_key is required when client_secret is omitted \"\n                \"(e.g., for PKCE public clients).\"\n            )\n\n        if not base_url:\n            raise ValueError(\"Missing required base URL\")\n\n        # Validate that verifier-specific parameters are not used with custom verifier\n        if token_verifier is not None:\n            if algorithm is not None:\n                raise ValueError(","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oidc_proxy.py#L332-L368","documentation":"OIDCProxy requires the URL of the provider's discovery/config document and raises ValueError at construction if config_url is falsy. Without it the proxy cannot discover the provider's endpoints.","triggerScenarios":"Calling OIDCProxy(...) with config_url=None, \"\", or omitted — often because an env var holding the URL was unset or the argument was misnamed.","commonSituations":"Missing OIDC_CONFIG_URL-style environment variable; YAML/env config not wired into the constructor; refactor renamed the parameter and the call site still passes the old kwarg positionally.","solutions":["Pass the provider's well-known config URL, e.g. https://idp.example.com/.well-known/openid-configuration","If it comes from an env var, ensure the variable is set and loaded before constructing the proxy","Check argument order/kwarg names so the value isn't silently dropped"],"exampleFix":"// before\nproxy = OIDCProxy(config_url=os.getenv(\"OIDC_CONFIG_URL\"), client_id=\"app\")  # env unset\n// after\nassert os.getenv(\"OIDC_CONFIG_URL\"), \"OIDC_CONFIG_URL not set\"\nproxy = OIDCProxy(config_url=os.environ[\"OIDC_CONFIG_URL\"], client_id=\"app\")","handlingStrategy":"validation","validationCode":"config_url = os.environ.get(\"OIDC_CONFIG_URL\")\nassert config_url, \"OIDC_CONFIG_URL must be set, e.g. https://idp/.well-known/openid-configuration\"","typeGuard":null,"tryCatchPattern":"try:\n    proxy = OIDCProxy(config_url=config_url, ...)\nexcept ValueError as e:\n    logger.error(\"OIDCProxy misconfigured: %s\", e)\n    raise SystemExit(1)","preventionTips":["Load env config before constructing auth providers","Use required-env checks at app startup (fail fast)","Keep provider config (config_url, client_id, secret, base_url) in one validated settings object"],"tags":["oidc","configuration","missing-parameter"],"backgroundTag":"missing-required-parameter","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}