git-ecosystem/git-credential-manager · error · InvalidOperationException

Public client configuration is required for user…

Error message

Public client configuration is required for user authentication.

What it means

Thrown from GetPublicAppBuilder when user (public client) authentication is attempted but no public client configuration (_publicClientConfig) has been set on the EntraAuthentication instance. Public client flows (interactive, device code, broker) require this configuration; without it the builder cannot be created.

Solutions

1. Provide a public client configuration when constructing/configuring EntraAuthentication before calling user-authentication APIs.
2. Ensure you are calling the correct token method for your setup: use client-credential flows for confidential clients instead of GetTokenForUserAsync.
3. Check initialization order — the public client config must be set before the first GetTokenForUser* call.

Example fix

// before
var auth = new EntraAuthentication(context);
var token = await auth.GetTokenForUserAsync(scopes); // throws: no public client config
// after
var auth = EntraAuthentication.CreateWithPublicClientConfig(context, publicClientConfig);
var token = await auth.GetTokenForUserAsync(scopes);

if (publicClientConfig is null)
    throw new InvalidOperationException("Public client configuration must be provided before user authentication.");

try
{
    token = await auth.GetTokenForUserAsync(scopes);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("Public client configuration"))
{
    // re-initialize with a public client configuration, then retry once
    auth = ConfigurePublicClient();
    token = await auth.GetTokenForUserAsync(scopes);
}

When it happens

Trigger: Calling GetTokenForUserAsync (directly or via GetInteractionModeAsync) on an EntraAuthentication instance that was constructed/configured only for confidential/client flows, without supplying a public client configuration.

Common situations: Mixing up service-principal and user authentication setup — the code path is initialized for client credentials but user token acquisition is requested; a configuration object was never passed to the EntraAuthentication constructor/factory; refactoring removed the public client setup call.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unexpected interaction mode.
• No authentication mode selected!
• Must specify at least one
• Must specify at least one AuthenticationModes
• Unknown authentication mode

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/0e64265ab4231e85. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/EntraAuthentication.PublicClient.cs:444

    private Task ShowDeviceCodeAsync(DeviceCodeResult dcr)
    {
        Context.Console.WriteLine(dcr.Message);
        return Task.CompletedTask;
    }

    private PublicClientApplicationBuilder _publicBuilder;
    private bool _useBroker;

    /// <summary>
    /// Gets the public client application builder.
    /// </summary>
    /// <param name="useBroker">True if the broker will be used for this applications build using this builder.</param>
    private PublicClientApplicationBuilder GetPublicAppBuilder(out bool useBroker)
    {
        if (_publicClientConfig is null)
        {
            throw new InvalidOperationException(
                "Public client configuration is required for user authentication.");
        }

        if (_publicBuilder is null)
        {
            Context.Trace.WriteLine("Creating public client application builder...");
            var builder = PublicClientApplicationBuilder.Create(_publicClientConfig.ClientId)
                .WithHttpClientFactory(_httpFactory)
                .WithTraceLogging(Context)
                .WithLegacyCacheCompatibility(false)
                .WithDefaultRedirectUri();

            // Try and configure the broker if the user has opted in to using it,
            // and it is available in the current environment
            if (Context.SessionManager.IsDesktopSession && IsBrokerEnabled())
            {
                // Check that the app config supports the broker on this platform
                if (_publicClientConfig.SupportsWindowsBroker && PlatformUtils.IsWindows() ||

View on GitHub (pinned to e8ce762cd0)