git-ecosystem/git-credential-manager · error · ArgumentException

Bitbucket DC OAuth Client Secret must be defined

Error message

Bitbucket DC OAuth Client Secret must be defined

What it means

BitbucketOAuth2Client.GetClientSecret reads the OAuth client secret from the Git credential config (DataCenterConstants...OAuthClientSecret). When absent it throws ArgumentException because the OAuth2 token exchange cannot proceed without the secret paired to the client ID.

Solutions

1. Set the secret: git config --global credential.bitbucketDCOAuthClientSecret <your-secret>
2. Confirm both bitbucketDCOAuthClientId and bitbucketDCOAuthClientSecret are set for the same host scope.
3. Re-run the DC setup instructions to provision the OAuth application secret from the Bitbucket admin console.

Example fix

// before: only client id set, secret lookup fails
$ git config --global credential.bitbucketDCOAuthClientId 0a1b2c3d
// after: also set the secret
$ git config --global credential.bitbucketDCOAuthClientId 0a1b2c3d
$ git config --global credential.bitbucketDCOAuthClientSecret s3cr3t

$ git config --get credential.bitbucketDCOAuthClientSecret || echo "client secret missing"

try { await oauth2Client.GetCredentialAsync(); } catch (ArgumentException ex) when (ex.Message.Contains("Client Secret")) { /* prompt admin to configure the OAuth app secret */ }

When it happens

Trigger: Running the Bitbucket DC OAuth2 flow when `credential.bitbucketDCOAuthClientSecret` is not present in Git configuration, even if the client ID is set.

Common situations: Admin configured only the client ID and forgot the secret; secret stored under wrong config scope; users copying setup docs that cover only the ID field; CI containers with partial config injection.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Bitbucket DC OAuth Client ID must be defined
• RemoteUri must be defined to generate Bitbucket DC OAuth2…
• RemoteUri must be defined to generate Bitbucket DC OAuth2…
• User cancelled dialog.
• Unknown authentication mode

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/62ea5defa6f7c78e. Report an issue: GitHub.

Appendix: source

Thrown at src/Atlassian.Bitbucket/DataCenter/BitbucketOAuth2Client.cs:66

            {
                return redirectUri;
            }

            return DataCenterConstants.OAuth2RedirectUri;
        }

        private static string GetClientSecret(ISettings settings)
        {
            // Check for developer override value
            if (settings.TryGetSetting(
                DataCenterConstants.EnvironmentVariables.OAuthClientSecret,
                Constants.GitConfiguration.Credential.SectionName, DataCenterConstants.GitConfiguration.Credential.OAuthClientSecret,
                out string clientSecret))
            {
                return clientSecret;
            }

            throw new ArgumentException("Bitbucket DC OAuth Client Secret must be defined");
        }

        private static OAuth2ServerEndpoints GetEndpoints(ISettings settings)
        {
            var remoteUri = settings.RemoteUri;
            if (remoteUri == null)
            {
                throw new ArgumentException("RemoteUri must be defined to generate Bitbucket DC OAuth2 endpoint Urls");
            }

            return new OAuth2ServerEndpoints(
                new Uri(BitbucketHelper.GetBaseUri(remoteUri) + "/rest/oauth2/latest/authorize"),
                new Uri(BitbucketHelper.GetBaseUri(remoteUri) + "/rest/oauth2/latest/token")
                );
        }
    }
}

View on GitHub (pinned to e8ce762cd0)