{"record":{"id":"97450c7676669eb0","repo":"googleapis/mcp-toolbox","slug":"client-id-and-client-secret-need-to-be-specified","errorCode":null,"errorMessage":"client_id and client_secret need to be specified","messagePattern":"client_id and client_secret need to be specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/looker/looker.go","lineNumber":132,"sourceCode":"\t\tVerifySsl:    r.SslVerification,\n\t\tTimeout:      int32(duration.Seconds()),\n\t\tClientId:     r.ClientId,\n\t\tClientSecret: r.ClientSecret,\n\t}\n\n\tvar tokenSource oauth2.TokenSource\n\ttokenSource, _ = initGoogleCloudConnection(ctx)\n\n\ts := &Source{\n\t\tConfig:              r,\n\t\tApiSettings:         &cfg,\n\t\tTokenSource:         tokenSource,\n\t\tAuthTokenHeaderName: \"Authorization\",\n\t}\n\n\tif strings.ToLower(r.UseClientOAuth) == \"false\" {\n\t\tif r.ClientId == \"\" || r.ClientSecret == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"client_id and client_secret need to be specified\")\n\t\t}\n\t\ts.Client = v4.NewLookerSDK(rtl.NewAuthSession(cfg))\n\t\tresp, err := s.Client.Me(\"\", s.ApiSettings)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"incorrect settings: %w\", err)\n\t\t}\n\t\tlogger.DebugContext(ctx, fmt.Sprintf(\"logged in as %s %s\", *resp.FirstName, *resp.LastName))\n\t} else {\n\t\tif strings.ToLower(r.UseClientOAuth) != \"true\" {\n\t\t\ts.AuthTokenHeaderName = r.UseClientOAuth\n\t\t}\n\t\tlogger.DebugContext(ctx, fmt.Sprintf(\"Using AuthTokenHeaderName: %s\", s.AuthTokenHeaderName))\n\t}\n\n\treturn s, nil\n\n}\n","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/looker/looker.go#L114-L150","documentation":"When useClientOAuth is not \"true\", the Looker source authenticates the server itself using a client credential session; it requires both client_id and client_secret to be present in the config. If either is empty, Initialize refuses to proceed with this error. Only the client OAuth mode (delegated per-request tokens) may omit them.","triggerScenarios":"Config with useClientOAuth false/unset and either client_id or client_secret empty at Initialize time.","commonSituations":"Deploying with secrets passed via env vars/secret manager that failed to inject, leaving empty fields; forgetting to fill credentials when switching from client-OAuth mode back to server auth; YAML keys misnamed (clientId vs client_id).","solutions":["Set both client_id and client_secret in the Looker source config.","Verify the secret-injection mechanism (env var expansion, mounted secret) actually populated them.","If using per-user OAuth instead, set useClientOAuth: \"true\" so credentials are supplied per request."],"exampleFix":"# before\nsources:\n  looker:\n    kind: looker\n    baseUrl: https://mycompany.looker.com\n# after\nsources:\n  looker:\n    kind: looker\n    baseUrl: https://mycompany.looker.com\n    client_id: ${LOOKER_CLIENT_ID}\n    client_secret: ${LOOKER_CLIENT_SECRET}","handlingStrategy":"validation","validationCode":"// Go or pre-flight shell: fail fast when server-auth mode lacks credentials\nif !strings.EqualFold(cfg.UseClientOAuth, \"true\") && (cfg.ClientId == \"\" || cfg.ClientSecret == \"\") {\n    return errors.New(\"looker source needs client_id and client_secret (or set useClientOAuth: true)\")\n}\n// shell check before start:\n// [ -n \"$LOOKER_CLIENT_ID\" ] && [ -n \"$LOOKER_CLIENT_SECRET\" ] || echo 'missing Looker credentials'","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil {\n    if strings.Contains(err.Error(), \"client_id and client_secret need to be specified\") {\n        fmt.Println(\"Set client_id/client_secret in YAML or env-inject LOOKER_CLIENT_ID/LOOKER_CLIENT_SECRET.\")\n    }\n    return err\n}","preventionTips":["Inject credentials via env vars/secret manager and verify they expand before startup.","Use exactly the YAML keys client_id and client_secret (snake_case).","Choose one auth mode deliberately: server credentials OR useClientOAuth: \"true\"."],"tags":["looker","config","authentication","oauth"],"backgroundTag":"missing-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}