fatedier/frp · error

auth.oidc.clientID is required; auth.oidc.tokenEndpointURL i

Error message

auth.oidc.clientID is required; auth.oidc.tokenEndpointURL is required

What it means

Aggregate validation error from ValidateOIDCClientCredentialsConfig: OIDC client authentication is enabled but both auth.oidc.clientID and auth.oidc.tokenEndpointURL are unset. When frpc or frps uses oidc as the auth method, these two fields are the minimum required to obtain tokens from the identity provider; all individual failures are collected and joined with '; '. The combined message here means exactly two checks failed: empty ClientID and empty TokenEndpointURL.

Source

Thrown at pkg/config/v1/validation/oidc.go:56

		} else if tokenURL.Scheme != "http" && tokenURL.Scheme != "https" {
			errs = append(errs, "auth.oidc.tokenEndpointURL must use http or https")
		}
	}

	if _, ok := c.AdditionalEndpointParams["scope"]; ok {
		errs = append(errs, "auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead")
	}

	if c.Audience != "" {
		if _, ok := c.AdditionalEndpointParams["audience"]; ok {
			errs = append(errs, "cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience")
		}
	}

	if len(errs) == 0 {
		return nil
	}
	return errors.New(strings.Join(errs, "; "))
}

View on GitHub (pinned to 6c8a8d0a97)

Solutions

1. Set both auth.oidc.clientID and auth.oidc.tokenEndpointURL (absolute http/https URL) in the config that enables auth.method = "oidc".
2. If using ValueSource (file/exec) for these fields, verify the files exist and commands succeed — an unresolvable source yields an empty string and this error.
3. Check TOML table nesting: keys must be inside [auth.oidc], not under [auth] or [auth.token].
4. If OIDC was not intended, change auth.method back to "token" (default) and remove the oidc block.

Example fix

# before
[auth]
method = "oidc"
token = "abc"

# after
[auth]
method = "oidc"
[auth.oidc]
clientID = "frp-client"
clientSecret = "..."
tokenEndpointURL = "https://idp.example.com/oauth2/token"

// before enabling OIDC in a config
if cfg.Auth.Method == "oidc" {
    if cfg.Auth.OIDC.ClientID == "" || cfg.Auth.OIDC.TokenEndpointURL == "" {
        return fmt.Errorf("auth.method=oidc requires auth.oidc.clientID and auth.oidc.tokenEndpointURL")
    }
}

func oidcConfigComplete(a v1.AuthClientConfig) bool {
    return a.OIDC.ClientID != "" && a.OIDC.TokenEndpointURL != ""
}

if err := validation.ValidateOIDCClientCredentialsConfig(&cfg.Auth.OIDC); err != nil {
    if strings.Contains(err.Error(), "clientID is required") || strings.Contains(err.Error(), "tokenEndpointURL is required") {
        // fill the missing oidc fields or fall back to token auth
    }
    return err
}

When it happens

Trigger: Config with auth.method = "oidc" (or auth.additionalScopes including oidc) where the [auth.oidc] section is absent, empty, or only sets optional fields like scope/audience — so both ClientID and TokenEndpointURL stay at their zero values. Validation runs at config load of frpc/frps and returns the joined error.

Common situations: Enabling OIDC auth after copying a minimal example config that never filled in the oidc section; switching from token auth to oidc and forgetting provider credentials; secrets sourced from files/exec that fail to load and silently resolve to empty strings; misnesting the TOML so [auth.oidc] keys land under the wrong table.

Related errors

• exec configuration is required when type is 'exec'
• file path cannot be empty
• unsupported auth method: %s
• failed to parse OIDC CA certificate from file %q
• cannot specify both auth.token and auth.tokenSource

AI-assisted analysis of fatedier/frp@6c8a8d0a97 (2026-08-15). Data as JSON: /api/errors/fbac6fb3cf247add. Report an issue: GitHub.