decolua/9router · error

client_id is required

Error message

client_id is required

What it means

The OAuth client_id (or clientId) of the Microsoft Entra app used for the external IdP flow is required. It is stored in providerSpecificData and replayed in every refresh-token request body (client_id parameter). Missing/empty client_id aborts normalization.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:106

    throw new Error("CLIProxyAPI auth JSON is required");
  }

  const authMethod = normalizeString(input.auth_method || input.authMethod);
  if (authMethod && authMethod !== "external_idp") {
    throw new Error("Only external_idp Kiro auth is supported by this importer");
  }

  const accessToken = normalizeString(input.access_token || input.accessToken);
  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);
  const clientId = normalizeString(input.client_id || input.clientId);
  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);
  const profileArn = normalizeString(input.profile_arn || input.profileArn);
  const region = normalizeString(input.region) || DEFAULT_REGION;
  const scope = normalizeScope(input.scopes || input.scope);

  if (!accessToken) throw new Error("access_token is required");
  if (!refreshToken) throw new Error("refresh_token is required");
  if (!clientId) throw new Error("client_id is required");
  if (!scope) throw new Error("scopes is required");
  if (!profileArn) throw new Error("profile_arn is required");

  const payload = decodeJwtPayload(accessToken);
  const email = input.email || payload?.email || payload?.preferred_username || payload?.upn || payload?.sub || null;

  return {
    accessToken,
    refreshToken,
    expiresAt: resolveExpiresAt(input),
    email,
    providerSpecificData: {
      profileArn,
      region,
      authMethod: "external_idp",
      provider: "CLIProxyAPI",
      clientId,
      tokenEndpoint,

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Add client_id (or clientId) with the Entra application (client) ID GUID from your app registration
2. Re-export the auth file from the tool that created the login — it should contain client_id
3. If the app registration is gone, recreate it in Azure and redo the login flow
4. Confirm the key spelling: only client_id/clientId are recognized

Example fix

// before
{ "access_token": "...", "refresh_token": "...", "scopes": "openid" }
// after
{ "access_token": "...", "refresh_token": "...", "client_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "scopes": "openid" }

const cid = auth.client_id ?? auth.clientId;
if (typeof cid !== 'string' || !cid.trim()) throw new Error('client_id missing from Kiro auth');

function hasClientId(a) {
  return typeof a === 'object' && a !== null &&
    ['client_id', 'clientId'].some(k => typeof a[k] === 'string' && a[k].trim() !== '');
}

try {
  normalizeKiroExternalIdpAuth(auth);
} catch (e) {
  if (e.message === 'client_id is required') {
    console.error('Add the Entra app (client) ID to the auth document');
  }
  throw e;
}

When it happens

Trigger: Auth JSON without client_id/clientId, or an empty/whitespace value; hand-building the auth document and omitting the app registration's client id.

Common situations: Copying an auth template that doesn't include client_id; mixing fields from two auth files (tokens from one, metadata missing); a CLIProxyAPI version writing snake_case while you only copied camelCase keys (both accepted, but the value must exist under one of them).

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• clientId is required for external_idp refresh
• Zed callback must include user_id and access_token
• access_token is required
• refresh_token is required
• scopes is required

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/6e2081ba2807319a. Report an issue: GitHub.