{"id":"8c6fc938af348369","repo":"redis/node-redis","slug":"msal-client-id-and-msal-tenant-id-environment-vari","errorCode":null,"errorMessage":"MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must be set","messagePattern":"MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must be set","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/entraid/samples/auth-code-pkce/index.ts","lineNumber":41,"sourceCode":"\nconst app = express();\n\nconst sessionConfig = {\n  secret: process.env.SESSION_SECRET,\n  resave: false,\n  saveUninitialized: false,\n  cookie: {\n    secure: process.env.NODE_ENV === 'production', // Only use secure in production\n    httpOnly: true,\n    sameSite: 'lax',\n    maxAge: 3600000 // 1 hour\n  }\n} as const;\n\napp.use(session(sessionConfig));\n\nif (!process.env.MSAL_CLIENT_ID || !process.env.MSAL_TENANT_ID) {\n  throw new Error('MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must be set');\n}\n\n// Initialize MSAL provider with authorization code PKCE flow\nconst {\n  getPKCECodes,\n  createCredentialsProvider,\n  getAuthCodeUrl\n} = EntraIdCredentialsProviderFactory.createForAuthorizationCodeWithPKCE({\n  clientId: process.env.MSAL_CLIENT_ID,\n  redirectUri: process.env.REDIRECT_URI || 'http://localhost:3000/redirect',\n  authorityConfig: { type: 'multi-tenant', tenantId: process.env.MSAL_TENANT_ID },\n  tokenManagerConfig: DEFAULT_TOKEN_MANAGER_CONFIG\n});\n\napp.get('/login', async (req: AuthRequest, res: Response) => {\n  try {\n    // Generate PKCE Codes before starting the authorization flow\n    const pkceCodes = await getPKCECodes();","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/redis/node-redis/blob/bb5beb56578573910e2ee8f39681edc214c41398/packages/entraid/samples/auth-code-pkce/index.ts#L23-L59","documentation":"Startup guard in the auth-code-pkce sample (samples/auth-code-pkce/index.ts:40): the Entra ID authorization-code-with-PKCE provider needs a registered application's clientId (MSAL_CLIENT_ID) and the tenant to build the authority URL (MSAL_TENANT_ID). The sample throws at boot if either is missing because EntraIdCredentialsProviderFactory.createForAuthorizationCodeWithPKCE cannot function without them.","triggerScenarios":"Running the auth-code-pkce sample without MSAL_CLIENT_ID and/or MSAL_TENANT_ID in the environment/.env.","commonSituations":"App registration in Entra ID not yet created; .env.example copied but values left blank; running in an environment where the vars were not exported.","solutions":["Register an application in the Entra ID portal and copy its Application (client) ID and Directory (tenant) ID.","Add `MSAL_CLIENT_ID=<client-id>` and `MSAL_TENANT_ID=<tenant-id>` to packages/entraid/.env.","Add the sample's redirect URI (http://localhost:3000/redirect) to the app registration's redirect URIs.","Re-run the sample after exporting both variables."],"exampleFix":"# .env\nMSAL_CLIENT_ID=11111111-2222-3333-4444-555555555555\nMSAL_TENANT_ID=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","handlingStrategy":"validation","validationCode":"function requireEntraEnv() {\n  const { MSAL_CLIENT_ID, MSAL_TENANT_ID } = process.env;\n  if (!MSAL_CLIENT_ID || !MSAL_TENANT_ID) {\n    throw new Error('Register an Entra ID app and set MSAL_CLIENT_ID and MSAL_TENANT_ID in .env');\n  }\n  return { MSAL_CLIENT_ID, MSAL_TENANT_ID };\n}","typeGuard":"const hasEntraAppEnv = (): boolean =>\n  /^[0-9a-f-]{36}$/i.test(process.env.MSAL_CLIENT_ID ?? '') &&\n  /^[0-9a-f-]{36}$/i.test(process.env.MSAL_TENANT_ID ?? '');","tryCatchPattern":null,"preventionTips":["Register the app in Entra ID and copy client/tenant IDs into .env.","Add the redirect URI to the app registration.","Validate env at startup in a single loader.","Document required vars in .env.example."],"tags":["configuration","environment","sample","entraid","azure"],"analyzedSha":"bb5beb56578573910e2ee8f39681edc214c41398","analyzedAt":"2026-08-03T19:09:15.686Z","schemaVersion":2}