crewAIInc/crewAI · error · ValueError

introspection_client_id and introspection_client_secret are

Error message

introspection_client_id and introspection_client_secret are required when using token introspection

What it means

A pydantic ValidationError raised by OAuth2ServerAuth's model validator when introspection_url is set but either introspection_client_id or introspection_client_secret is missing. RFC 7662 introspection requires basic auth credentials, so the scheme refuses to construct without them. It fails at configuration time.

Source

Thrown at lib/crewai/src/crewai/a2a/auth/server_schemes.py:457

    clock_skew_seconds: float = Field(
        default=30.0,
        description="Allowed clock skew for token validation",
        ge=0.0,
    )

    _jwk_client: PyJWKClient | None = PrivateAttr(default=None)

    @model_validator(mode="after")
    def _validate_and_init(self) -> Self:
        """Validate configuration and initialize JWKS client if needed."""
        if not self.jwks_url and not self.introspection_url:
            raise ValueError(
                "Either jwks_url or introspection_url must be provided for token validation"
            )

        if self.introspection_url:
            if not self.introspection_client_id or not self.introspection_client_secret:
                raise ValueError(
                    "introspection_client_id and introspection_client_secret are required "
                    "when using token introspection"
                )

        if self.jwks_url:
            self._jwk_client = PyJWKClient(
                str(self.jwks_url), lifespan=self.jwks_cache_ttl
            )

        return self

    async def authenticate(self, token: str) -> AuthenticatedUser:
        """Authenticate using OAuth2 token validation.

        Uses JWKS validation if jwks_url is configured, otherwise falls back
        to token introspection.

        Args:

View on GitHub (pinned to 754d7323be)

Solutions

1. Register a confidential client with your IdP and pass both values: introspection_client_id='svc' and introspection_client_secret='...'.
2. If the secret comes from an env var or vault, assert it is non-empty before constructing the scheme.
3. Note the secret accepts a plain string (coerced to SecretStr via BeforeValidator) or a SecretStr instance.
4. Consider jwks_url-only validation if you cannot provision an introspection client.

Example fix

# before
auth = OAuth2ServerAuth(introspection_url="https://idp/introspect")  # ValidationError

# after
auth = OAuth2ServerAuth(
    introspection_url="https://idp/introspect",
    introspection_client_id="my-service",
    introspection_client_secret=os.environ["INTROSPECTION_SECRET"],
)

import os
from crewai.a2a.auth.server_schemes import OAuth2ServerAuth

client_id = os.environ["INTROSPECTION_CLIENT_ID"]
client_secret = os.environ["INTROSPECTION_CLIENT_SECRET"]
assert client_id and client_secret, "introspection requires both client id and secret"

auth = OAuth2ServerAuth(
    introspection_url="https://idp/oauth/introspect",
    introspection_client_id=client_id,
    introspection_client_secret=client_secret,
)

try:
    auth = OAuth2ServerAuth(**cfg)
except ValidationError as e:
    if "introspection_client_id and introspection_client_secret" in str(e):
        raise RuntimeError("register a confidential client with the IdP for introspection") from e

When it happens

Trigger: OAuth2ServerAuth(introspection_url='https://idp/introspect') without client credentials; secret provided but client_id omitted; credentials left as empty strings from unset env vars.

Common situations: Teams wiring introspection for the first time and forgetting the IdP requires a confidential client; env vars named inconsistently (INTROSPECT_CLIENT_ID vs INTROSPECTION_CLIENT_ID); secrets stored in a vault but not injected before config load.

Related errors

• Either jwks_url or introspection_url must be provided for to
• Authorization callback not set. Use set_authorization_callba
• OAuth2 introspection not configured
• Token introspection service unavailable
• Error. A valid pyproject.toml file is required. Check that a

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/f92e67397a2e1b02. Report an issue: GitHub.