theonedev/onedev · error · ExplicitException

Client secret needs to be specified to generate refresh toke

Error message

Client secret needs to be specified to generate refresh token

What it means

Same refresh-token callback in GmailConnector: after validating clientId, it requires the clientSecret input. A null client secret makes the OAuth authorization-code flow impossible, so an ExplicitException is thrown.

Source

Thrown at server-plugin/server-plugin-mail-gmail/src/main/java/io/onedev/server/plugin/mail/gmail/GmailConnector.java:130

	}
	
	@Editable(order=500, name="Check Incoming Email", description="Enable this to process issue or pull request comments posted via email")
	public InboxPollSetting getInboxPollSetting() {
		return inboxPollSetting;
	}

	public void setInboxPollSetting(InboxPollSetting inboxPollSetting) {
		this.inboxPollSetting = inboxPollSetting;
	}

	@SuppressWarnings("unused")
	private static RefreshToken.Callback getRefreshTokenCallback() {
		String clientId = (String) EditContext.get().getInputValue("clientId");
		if (clientId == null)
			throw new ExplicitException("Client ID needs to be specified to generate refresh token");
		String clientSecret = (String) EditContext.get().getInputValue("clientSecret");
		if (clientSecret == null)
			throw new ExplicitException("Client secret needs to be specified to generate refresh token");

		String accountName = (String) EditContext.get().getInputValue("accountName");
		if (accountName == null)
			throw new ExplicitException("Account name needs to be specified to generate refresh token");

		Collection<String> scopes = Lists.newArrayList("https://mail.google.com/");

		return new RefreshToken.Callback() {

			@Override
			public String getAuthorizeEndpoint() {
				return AUTHORIZE_ENDPOINT;
			}

			@Override
			public Map<String, String> getAuthorizeParams() {
				Map<String, String> params = new HashMap<>();
				params.put("access_type", "offline");

View on GitHub (pinned to d44925c47c)

Solutions

Enter the OAuth client secret (from Google Cloud Console credentials) in the form before generating the refresh token.
If the secret was lost, create a new one in Google Cloud Console and paste it in.
Verify the field is not blank-only (trailing whitespace) — re-enter the value.

Example fix

// before
clientSecret = null;
// after
clientSecret = "GOCSPX-xxxxxxxxxxxxxxxx";

Defensive patterns

Strategy: validation

Validate before calling

if (!clientSecret || clientSecret.trim() === "") throw new Error("Fill Client Secret before generating refresh token");

Try / catch

try {
    generateRefreshToken();
} catch (ExplicitException e) {
    alert("Complete the connector form first: " + e.getMessage());
}

Prevention

Keep the Google OAuth client secret handy when configuring the connector.
Regenerate the secret in Google Cloud Console if lost/expired.
Fill all OAuth fields before invoking the generate action.

When it happens

Trigger: Generating a refresh token for the Gmail connector with a Client ID filled in but the 'Client Secret' input empty in the edit form.

Common situations: User entered only the client ID; Google Cloud secret was regenerated and old one cleared; user assumed the secret is only needed at connection time, not token generation.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/c554da70ff65e2fc. Report an issue: GitHub.