{"record":{"id":"dc48a4173d4bdad9","repo":"microsoft/semantic-kernel","slug":"if-no-client-secret-is-provided-a-client-certific","errorCode":null,"errorMessage":"If no client_secret is provided, a client_certificate is required for service-to-service auth.","messagePattern":"If no client_secret is provided, a client_certificate is required for service-to-service auth\\.","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py","lineNumber":140,"sourceCode":"        return ConfidentialClientApplication(\n            client_id=self.settings.app_client_id,\n            authority=f\"https://login.microsoftonline.com/{self.settings.tenant_id}\",\n            token_cache=self.cache,\n            **extra_kwargs,\n        )\n\n    def _acquire_service_token(self) -> str:\n        if not self.client_secret and not self.client_cert_path:\n            raise AgentInitializationException(\n                \"client_secret *or* client_certificate is required for service-to-service auth.\"\n            )\n\n        kwargs: dict[str, Any] = {}\n        if self.client_secret:\n            kwargs[\"client_credential\"] = self.client_secret\n        else:  # certificate\n            if not self.client_cert_path:\n                raise AgentInitializationException(\n                    \"If no client_secret is provided, a client_certificate is required for service-to-service auth.\"\n                )\n            kwargs[\"client_credential\"] = {\n                \"private_key\": Path(self.client_cert_path).read_text(),\n                \"thumbprint\": self._cert_thumbprint(self.client_cert_path),\n            }\n\n        app = self._new_confidential_client(**kwargs)\n\n        # proactive caching\n        result = app.acquire_token_silent(self.scopes, account=None) or app.acquire_token_for_client(scopes=self.scopes)\n\n        return self._unwrap(result)\n\n    # interactive\n    def _acquire_interactive_token(self) -> str:\n        app = PublicClientApplication(\n            self.settings.app_client_id,","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py#L122-L158","documentation":"Raised by _CopilotStudioAgentTokenFactory._acquire_service_token (an AgentInitializationException) in the certificate branch when client_cert_path is falsy. This is a defensive re-check: the branch is only entered when client_secret is absent, and the code requires a certificate path to build the client_credential dict (private_key + thumbprint).","triggerScenarios":"SERVICE auth configured with neither a client_secret nor a client_certificate path; client_cert_path is None/empty inside the certificate branch. Effectively the same misconfiguration as 798, caught by the secondary guard.","commonSituations":"Omitting both credentials; certificate path not loaded from config; logic that sets client_secret conditionally leaving it None while also not setting client_certificate.","solutions":["Provide a client_certificate Path when not using a client_secret.","Load the certificate path from your secret/config store and confirm it is non-empty before building the factory.","Since SERVICE mode is currently gated (error 797), prefer INTERACTIVE until supported; if SERVICE is needed later, supply exactly one of secret or cert.","Ensure the cert file path is valid and readable so downstream private_key/thumbprint extraction works."],"exampleFix":"// before\nfactory = _CopilotStudioAgentTokenFactory(settings=..., mode=SERVICE, cache_path=...)  # no creds\n// after\nfrom pathlib import Path\nfactory = _CopilotStudioAgentTokenFactory(\n    settings=..., mode=SERVICE, cache_path=..., client_certificate=Path('/etc/cs/cert.pem'))","handlingStrategy":"validation","validationCode":"from pathlib import Path\ndef validate_cert(client_cert_path):\n    if not client_cert_path:\n        raise ValueError('client_certificate path required when no client_secret is provided')\n    p = Path(client_cert_path)\n    if not p.is_file():\n        raise FileNotFoundError(f'Certificate not found: {client_cert_path}')\n    return p","typeGuard":null,"tryCatchPattern":"from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException\ntry:\n    token = factory._acquire_service_token()\nexcept AgentInitializationException as e:\n    if 'client_certificate is required' in str(e):\n        raise RuntimeError('Provide a client_certificate Path for service auth')\n    raise","preventionTips":["Provide a readable certificate path when not using a secret","Use INTERACTIVE mode until SERVICE is supported","Verify the cert file exists before building the factory"],"tags":["copilot-studio","authentication","configuration","secrets"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}