gravitational/teleport · error

invalid Graph API credentials

Error message

invalid Graph API credentials

What it means

Exported sentinel ErrInvalidCredentials returned by msgraph Client.VerifyCredentials when Azure AD rejects the client ID or client secret during token acquisition; it also appears in webauthn login (different sentinel, same message shape) when a user has only invalid WebAuthn registrations.

Source

Thrown at lib/msgraph/creds.go:36

// the Graph API and if they're authorized to get specific resources.
package msgraph

import (
	"context"
	"errors"
	"net/http"
	"slices"

	"github.com/gravitational/trace"
)

var (
	// ErrTenantNotFound is returned by [Client.VerifyCredentials] when getting a token fails due to
	// the tenant not being found. It might also point to the subscription no longer being active.
	ErrTenantNotFound = errors.New("tenant not found")
	// ErrInvalidCredentials is returned by [Client.VerifyCredentials] when getting a token fails due
	// to an invalid client ID or secret.
	ErrInvalidCredentials = errors.New("invalid Graph API credentials")
	// ErrClientUnauthorized is returned by [Client.VerifyCredentials] in a situation where the app
	// either doesn't have the permission required to access certain resources or the permission
	// hasn't been grated by the administrator yet.
	ErrClientUnauthorized = errors.New("authentication was successful but application does not have necessary permissions")
)

// IsCredentialsError determines whether err is one of the special errors returned by
// [Client.VerifyCredentials].
func IsCredentialsError(err error) bool {
	return errors.Is(err, ErrTenantNotFound) ||
		errors.Is(err, ErrInvalidCredentials) ||
		errors.Is(err, ErrClientUnauthorized)
}

// VerifyCredentials expects getResourcesFunc to call a method on [Client]. It then inspects the
// returned error to check for Graph or token errors related to credentials being insufficient in
// some way.
func (c *Client) VerifyCredentials(ctx context.Context, getResourcesFunc func(ctx context.Context, client *Client) error) error {

View on GitHub (pinned to 1283425b60)

Solutions

1. Check the client ID and client secret configured in the Azure/Entra integration and rotate them if stale
2. For the WebAuthn variant, perform a user reset (tsh admin) to clear invalid registrations

When it happens

Trigger: Thrown at lib/msgraph/creds.go:36 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/c6029b60f85dda59. Report an issue: GitHub.