{"record":{"id":"e85d9a022e6d857f","repo":"microsoft/semantic-kernel","slug":"client-secret-or-client-certificate-is-required","errorCode":null,"errorMessage":"client_secret *or* client_certificate is required for service-to-service auth.","messagePattern":"client_secret \\*or\\* client_certificate is required for service-to-service auth\\.","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py","lineNumber":131,"sourceCode":"            )\n\n        match self.mode:\n            case CopilotStudioAgentAuthMode.SERVICE:\n                return self._acquire_service_token()  # unreachable until the guard is removed\n            case _:\n                return self._acquire_interactive_token()\n\n    def _new_confidential_client(self, **extra_kwargs) -> ConfidentialClientApplication:\n        return ConfidentialClientApplication(\n            client_id=self.settings.app_client_id,\n            authority=f\"https://login.microsoftonline.com/{self.settings.tenant_id}\",\n            token_cache=self.cache,\n            **extra_kwargs,\n        )\n\n    def _acquire_service_token(self) -> str:\n        if not self.client_secret and not self.client_cert_path:\n            raise AgentInitializationException(\n                \"client_secret *or* client_certificate is required for service-to-service auth.\"\n            )\n\n        kwargs: dict[str, Any] = {}\n        if self.client_secret:\n            kwargs[\"client_credential\"] = self.client_secret\n        else:  # certificate\n            if not self.client_cert_path:\n                raise AgentInitializationException(\n                    \"If no client_secret is provided, a client_certificate is required for service-to-service auth.\"\n                )\n            kwargs[\"client_credential\"] = {\n                \"private_key\": Path(self.client_cert_path).read_text(),\n                \"thumbprint\": self._cert_thumbprint(self.client_cert_path),\n            }\n\n        app = self._new_confidential_client(**kwargs)\n","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py#L113-L149","documentation":"Raised by _CopilotStudioAgentTokenFactory._acquire_service_token (an AgentInitializationException) when neither client_secret nor client_cert_path is provided. Service-to-service (confidential client) auth requires exactly one credential, so an empty configuration is rejected before building the MSAL confidential client.","triggerScenarios":"Configuring SERVICE auth without supplying client_secret or client_certificate; both credential parameters left at their defaults (None) on the token factory/agent.","commonSituations":"Incomplete environment/config for service auth (missing env vars for secret or cert path); copy-paste config that omitted the credential; planning to use SERVICE mode (which is itself gated by error 797) without the credential wired.","solutions":["Provide a client_secret or a client_certificate (Path) when setting up SERVICE auth.","Supply credentials via environment variables / secret store rather than hardcoding; verify they are loaded.","Since SERVICE mode is currently gated (error 797), use INTERACTIVE mode until SERVICE is supported, then add the credential.","Validate that the cert path exists and is readable if using a certificate."],"exampleFix":"// before\nfactory = _CopilotStudioAgentTokenFactory(settings=..., mode=SERVICE, cache_path=...)  # no secret/cert\nfactory._acquire_service_token()  # raises\n// after\nfactory = _CopilotStudioAgentTokenFactory(\n    settings=..., mode=SERVICE, cache_path=..., client_secret=os.environ['CS_CLIENT_SECRET'])","handlingStrategy":"validation","validationCode":"def validate_service_creds(client_secret, client_cert_path):\n    if not client_secret and not client_cert_path:\n        raise ValueError('Provide client_secret or client_certificate for service auth')\n    return True","typeGuard":null,"tryCatchPattern":"from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException\ntry:\n    token = factory._acquire_service_token()\nexcept AgentInitializationException as e:\n    if 'client_secret' in str(e):\n        raise RuntimeError('Missing Copilot Studio service credential; set CS_CLIENT_SECRET or cert path')\n    raise","preventionTips":["Supply exactly one of client_secret or client_certificate for service auth","Load credentials from a secret store, not hardcoded","Prefer INTERACTIVE mode until SERVICE is fully supported"],"tags":["copilot-studio","authentication","configuration","secrets"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}