siyuan-note/siyuan · error

GitHub OAuth client secret is required

Error message

GitHub OAuth client secret is required

What it means

Thrown by oidc_provider.New() when the provider is GitHub (conf.OIDCProviderGitHub) and config.ClientSecret is empty. GitHub's OAuth flow is the only provider in this constructor that requires a client secret upfront (others are validated later or use PKCE). The secret authenticates the server-to-server token exchange with GitHub.

Source

Thrown at kernel/model/oidc_provider/provider.go:46

type Provider struct {
	kind         string
	oauth2Config *oauth2.Config
	verifier     *oidc.IDTokenVerifier
}

func New(ctx context.Context, config *conf.OIDC, redirectURL string) (*Provider, error) {
	if config == nil {
		return nil, errors.New("OIDC configuration is missing")
	}
	if config.ClientID == "" {
		return nil, errors.New("OIDC client ID is required")
	}
	if redirectURL == "" {
		return nil, errors.New("OIDC redirect URL is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return nil, errors.New("GitHub OAuth client secret is required")
	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:
		return newGitHub(config, redirectURL), nil
	default:
		return nil, fmt.Errorf("unsupported OIDC provider [%s]", config.Provider)
	}
	if issuerURL == "" {
		return nil, errors.New("OIDC issuer URL is required")
	}
	discovered, err := oidc.NewProvider(ctx, issuerURL)
	if err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Go to GitHub Settings - Developer settings - OAuth Apps, open the app, and copy the Client Secret into SiYuan's OIDC settings.
2. If the secret was lost, generate a new one in the GitHub OAuth App page and update SiYuan's config.
3. Validate the ClientSecret field in the API handler when provider is GitHub before calling New().

Example fix

// before
// provider=GitHub but ClientSecret empty
provider, err := oidc_provider.New(ctx, config, redirectURL)

// after
if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
    return nil, errors.New("GitHub OAuth client secret is required")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
    return nil, errors.New("GitHub OAuth client secret is required")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

func hasGitHubSecret(c *conf.OIDC) bool {
    if c.Provider != conf.OIDCProviderGitHub {
        return true
    }
    return c.ClientSecret != ""
}

When it happens

Trigger: Calling New() with config.Provider == conf.OIDCProviderGitHub and an empty ClientSecret. All other providers skip this check, but GitHub's token endpoint requires the secret for the server-side exchange.

Common situations: The admin selected GitHub as the OIDC provider and entered the Client ID but forgot to paste the Client Secret from the GitHub OAuth App settings. The GitHub OAuth App was created as a new app (which always issues a secret) but it was not copied into SiYuan's config.

Related errors

• OIDC redirect URL is required
• GitHub OAuth client secret is required
• OIDC configuration is missing
• OIDC client ID is required
• unsupported OIDC provider [%s]

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/e019986bd78b5946. Report an issue: GitHub.