redis/node-redis · error · Error

MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must

Error message

MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must be set

What it means

Startup guard in the auth-code-pkce sample (samples/auth-code-pkce/index.ts:40): the Entra ID authorization-code-with-PKCE provider needs a registered application's clientId (MSAL_CLIENT_ID) and the tenant to build the authority URL (MSAL_TENANT_ID). The sample throws at boot if either is missing because EntraIdCredentialsProviderFactory.createForAuthorizationCodeWithPKCE cannot function without them.

Source

Thrown at packages/entraid/samples/auth-code-pkce/index.ts:41

const app = express();

const sessionConfig = {
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production', // Only use secure in production
    httpOnly: true,
    sameSite: 'lax',
    maxAge: 3600000 // 1 hour
  }
} as const;

app.use(session(sessionConfig));

if (!process.env.MSAL_CLIENT_ID || !process.env.MSAL_TENANT_ID) {
  throw new Error('MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must be set');
}

// Initialize MSAL provider with authorization code PKCE flow
const {
  getPKCECodes,
  createCredentialsProvider,
  getAuthCodeUrl
} = EntraIdCredentialsProviderFactory.createForAuthorizationCodeWithPKCE({
  clientId: process.env.MSAL_CLIENT_ID,
  redirectUri: process.env.REDIRECT_URI || 'http://localhost:3000/redirect',
  authorityConfig: { type: 'multi-tenant', tenantId: process.env.MSAL_TENANT_ID },
  tokenManagerConfig: DEFAULT_TOKEN_MANAGER_CONFIG
});

app.get('/login', async (req: AuthRequest, res: Response) => {
  try {
    // Generate PKCE Codes before starting the authorization flow
    const pkceCodes = await getPKCECodes();

View on GitHub (pinned to bb5beb5657)

Solutions

1. Register an application in the Entra ID portal and copy its Application (client) ID and Directory (tenant) ID.
2. Add `MSAL_CLIENT_ID=<client-id>` and `MSAL_TENANT_ID=<tenant-id>` to packages/entraid/.env.
3. Add the sample's redirect URI (http://localhost:3000/redirect) to the app registration's redirect URIs.
4. Re-run the sample after exporting both variables.

Example fix

# .env
MSAL_CLIENT_ID=11111111-2222-3333-4444-555555555555
MSAL_TENANT_ID=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

function requireEntraEnv() {
  const { MSAL_CLIENT_ID, MSAL_TENANT_ID } = process.env;
  if (!MSAL_CLIENT_ID || !MSAL_TENANT_ID) {
    throw new Error('Register an Entra ID app and set MSAL_CLIENT_ID and MSAL_TENANT_ID in .env');
  }
  return { MSAL_CLIENT_ID, MSAL_TENANT_ID };
}

const hasEntraAppEnv = (): boolean =>
  /^[0-9a-f-]{36}$/i.test(process.env.MSAL_CLIENT_ID ?? '') &&
  /^[0-9a-f-]{36}$/i.test(process.env.MSAL_TENANT_ID ?? '');

When it happens

Trigger: Running the auth-code-pkce sample without MSAL_CLIENT_ID and/or MSAL_TENANT_ID in the environment/.env.

Common situations: App registration in Entra ID not yet created; .env.example copied but values left blank; running in an environment where the vars were not exported.

Related errors

• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must
• SESSION_SECRET environment variable must be set
• SESSION_SECRET environment variable must be set
• Invalid authority configuration
• Invalid token response

AI-assisted analysis of redis/node-redis@bb5beb5657 (2026-08-03). Data as JSON: /data/errors/8c6fc938af348369.json. Report an issue: GitHub.