{"record":{"id":"d79fd0c41814c8ea","repo":"Dokploy/dokploy","slug":"azure-key-vault-authentication-failed-status-r","errorCode":null,"errorMessage":"Azure Key Vault: authentication failed (status ${response.status}${detail ? `: ${detail}` : \"\"})","messagePattern":"Azure Key Vault: authentication failed \\(status (.+?)(.+?)` : \"\"\\}\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/server/src/utils/vault/azure.ts","lineNumber":33,"sourceCode":"\t\tclient_secret: config.clientSecret,\n\t\tscope: \"https://vault.azure.net/.default\",\n\t});\n\tconst response = await vaultFetch(\n\t\t`https://login.microsoftonline.com/${encodeURIComponent(config.tenantId)}/oauth2/v2.0/token`,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\t\tbody: body.toString(),\n\t\t},\n\t);\n\n\tif (!response.ok) {\n\t\tlet detail = \"\";\n\t\ttry {\n\t\t\tconst body = (await response.json()) as { error_description?: string };\n\t\t\tdetail = (body.error_description ?? \"\").split(\"\\n\")[0] ?? \"\";\n\t\t} catch {}\n\t\tthrow new Error(\n\t\t\t`Azure Key Vault: authentication failed (status ${response.status}${detail ? `: ${detail}` : \"\"})`,\n\t\t);\n\t}\n\n\tconst data = (await response.json()) as { access_token?: string };\n\tif (!data.access_token) {\n\t\tthrow new Error(\"Azure Key Vault: no access token returned\");\n\t}\n\treturn data.access_token;\n};\n\nconst readSecret = async (config: AzureConfig, token: string, name: string) => {\n\tconst response = await vaultFetch(\n\t\t`${baseUrl(config)}/secrets/${encodeURIComponent(name)}?api-version=${API_VERSION}`,\n\t\t{ headers: { Authorization: `Bearer ${token}` } },\n\t);\n\n\tif (response.status === 404) {","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/utils/vault/azure.ts#L15-L51","documentation":"getAccessToken POSTs credentials to the Azure AD OAuth token endpoint; a non-2xx means authentication failed. The code extracts the first line of error_description for detail, so the message includes Azure's reason (e.g. AADSTS7000215 invalid client secret, AADSTS700016 wrong tenant/app).","triggerScenarios":"Wrong tenantId/clientId/clientSecret, expired or rotated client secret, service principal deleted/disabled, or using login.microsoftonline.com against a national cloud tenant.","commonSituations":"Secret expired (Azure secrets have expiries) and wasn't rotated; copied tenant ID from the wrong directory; app registration removed.","solutions":["Match the AADSTS code in the message: AADSTS7000215 → wrong client secret; AADSTS700016 → wrong clientId/tenant; AADSTS70002 → missing/invalid secret","Generate a new client secret in the app registration and update the vault config","Verify tenantId is the directory containing the app registration","Wait a few minutes after adding a new secret — Azure propagation can lag"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// no safe precheck over network; verify config shape locally first\nif (!tenantId || !clientId || !clientSecret) throw new Error('Incomplete Azure vault config');","typeGuard":"const isCompleteAzureConfig = (c: unknown): c is { tenantId: string; clientId: string; clientSecret: string } =>\n  typeof c === 'object' && c !== null &&\n  ['tenantId','clientId','clientSecret'].every(k => typeof (c as any)[k] === 'string' && (c as any)[k].length > 0);","tryCatchPattern":"try {\n  await getAccessToken(cfg);\n} catch (e) {\n  const msg = String(e);\n  if (/AADSTS7000215/.test(msg)) throw new Error('Invalid client secret — rotate it in Azure');\n  if (/AADSTS700016/.test(msg)) throw new Error('Wrong clientId or tenantId');\n  throw e;\n}","preventionTips":["Set calendar reminders for client-secret expiry","Copy IDs from the app registration's Overview page in the correct tenant","Retry once after adding a new secret to allow Azure propagation"],"tags":["azure","key-vault","oauth","authentication"],"backgroundTag":"oauth-client-authentication-failed","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}