chenhg5/cc-connect · error

current environment does not support client_secret auth

Error message

current environment does not support client_secret auth

What it means

This error is thrown during the Feishu/Lark bot registration (QR onboarding) flow when the remote registration service's 'init' response reports a list of supported auth methods that does not include 'client_secret'. The flow only supports registering the bot via the client_secret auth method, so it aborts early rather than proceeding to a doomed device-code exchange. It indicates a server-side/environment restriction, not a local code bug.

Source

Thrown at cmd/cc-connect/feishu.go:552

func runRegistrationFlow(opts registrationFlowOptions) (*registrationFlowResult, error) {
	if opts.TimeoutSeconds <= 0 {
		opts.TimeoutSeconds = 600
	}
	client := &registrationClient{
		baseURL: accountsFeishuBaseURL,
		http:    &http.Client{Timeout: 15 * time.Second},
		debug:   opts.Debug,
	}

	var initRes registrationInitResponse
	if err := client.registrationCall("init", nil, &initRes); err != nil {
		return nil, fmt.Errorf("init failed: %w", err)
	}
	if initRes.Error != "" {
		return nil, fmt.Errorf("%s: %s", initRes.Error, initRes.ErrorDescription)
	}
	if len(initRes.SupportedAuthMethods) > 0 && !containsString(initRes.SupportedAuthMethods, "client_secret") {
		return nil, fmt.Errorf("current environment does not support client_secret auth")
	}

	var beginRes registrationBeginResponse
	beginParams := map[string]string{
		"archetype":         "PersonalAgent",
		"auth_method":       "client_secret",
		"request_user_info": "open_id",
	}
	if err := client.registrationCall("begin", beginParams, &beginRes); err != nil {
		return nil, fmt.Errorf("begin failed: %w", err)
	}
	if beginRes.Error != "" {
		return nil, fmt.Errorf("%s: %s", beginRes.Error, beginRes.ErrorDescription)
	}
	if beginRes.DeviceCode == "" || beginRes.VerificationURIComplete == "" {
		return nil, fmt.Errorf("incomplete onboarding response")
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Check the environment/tenant: switch to a Feishu/Lark environment that permits client_secret-based onboarding (or a different baseURL, e.g. the Lark accounts endpoint if registering a Lark tenant).
2. Inspect the debug output (registrationClient debug mode) to see the actual SupportedAuthMethods list returned by init and confirm what is supported.
3. Upgrade cc-connect to a version that supports the auth methods your environment offers, or use an alternate setup path (manual app credentials in config.toml instead of QR onboarding).
4. Contact Feishu/Lark open-platform support to enable client_secret auth for your environment if it should be supported.

Example fix

// before
if len(initRes.SupportedAuthMethods) > 0 && !containsString(initRes.SupportedAuthMethods, "client_secret") {
	return nil, fmt.Errorf("current environment does not support client_secret auth")
}
// after
// no code fix: pick an auth method the environment supports
// e.g. re-run setup against the Lark endpoint:
//   cc-connect setup feishu --base-url https://accounts.larksuite.com
// or configure app_id/app_secret manually in config.toml

// cannot pre-validate remotely; but before running setup you can check which platform env you target
if strings.Contains(os.Getenv("CC_CONNECT_REGION"), "lark") {
	// ensure setup uses the Lark endpoint that supports client_secret
}

When it happens

Trigger: runRegistrationFlow calls registrationCall("init") and the response contains a non-empty SupportedAuthMethods array that lacks the "client_secret" entry (e.g. only ["qr_code"] or ["oauth_code"]).

Common situations: Registering a bot in a Feishu/Lark tenant or environment where the onboarding API has disabled client_secret-based onboarding; using an older/self-hosted registration endpoint with a restricted auth-method policy; environment policy changes rolled out server-side after a working setup.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• authorization denied by user
• init failed: %w
• %s: %s
• begin failed: %w
• incomplete onboarding response

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/4c892de4e84d1646. Report an issue: GitHub.