larksuite/cli · error

SecretRef.id must be non-empty

Error message

SecretRef.id must be non-empty

What it means

SecretInput.UnmarshalJSON requires SecretRef.id to be a non-empty string. The id identifies which secret the provider should fetch; an empty id is unresolvable, so unmarshal fails fast instead of producing a ref that errors at lookup.

Source

Thrown at internal/binding/types.go:107

// UnmarshalJSON handles both string and object forms of SecretInput.
func (s *SecretInput) UnmarshalJSON(data []byte) error {
	// Try string first
	var str string
	if err := json.Unmarshal(data, &str); err == nil {
		s.Plain = str
		s.Ref = nil
		return nil
	}

	// Try SecretRef object
	var ref SecretRef
	if err := json.Unmarshal(data, &ref); err == nil {
		if !validSources[ref.Source] {
			return fmt.Errorf("SecretRef.source must be env|file|exec, got %q", ref.Source)
		}
		if ref.ID == "" {
			return fmt.Errorf("SecretRef.id must be non-empty")
		}
		s.Ref = &ref
		s.Plain = ""
		return nil
	}

	return fmt.Errorf("appSecret must be a string or {source, provider?, id} object")
}

// MarshalJSON serializes SecretInput back to JSON.
func (s SecretInput) MarshalJSON() ([]byte, error) {
	if s.Ref != nil {
		return json.Marshal(s.Ref)
	}
	return json.Marshal(s.Plain)
}

// SecretsConfig captures the secrets.providers registry from openclaw.json.

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Set id to the secret name/key the provider should resolve
2. If the value is meant to be literal plaintext, pass a plain string instead of a ref object
3. Check that the env var or config template supplying the id expands to a non-empty value

Example fix

// before
{"appSecret": {"source": "env", "id": ""}}
// after
{"appSecret": {"source": "env", "id": "FEISHU_APP_SECRET"}}

if ref.ID == "" {
    return errors.New("secretRef.id must be non-empty")
}

func hasSecretID(m map[string]any) bool {
    id, ok := m["id"].(string)
    return ok && id != ""
}

When it happens

Trigger: Parsing a SecretRef object with an empty or missing id, e.g. {"source":"env"} or {"source":"env","id":""}.

Common situations: Template-expanded config where a placeholder variable was empty; deleting the id value during refactoring; copy-paste dropping the id field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• SecretRef.source must be env|file|exec, got %q
• appSecret must be a string or {source, provider?, id} object
• malformed config
• file provider path is empty
• singleValue file provider expects ref id %q, got %q

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/4b9e40805fe18f09. Report an issue: GitHub.