zeroclaw-labs/zeroclaw · error

microsoft365.auth_flow must be client_credentials or device_

Error message

microsoft365.auth_flow must be client_credentials or device_code

What it means

Second copy of the Microsoft 365 auth_flow guard (schema.rs:21751-21754) with the unquoted message wording. Same rule as error 472: trimmed auth_flow must equal "client_credentials" or "device_code" exactly. Because the identical first block runs first, this variant only surfaces in builds where that block is removed or reordered — expect the quoted wording in current binaries.

Source

Thrown at crates/zeroclaw-config/src/schema.rs:21753

            if tenant.is_none() {
                anyhow::bail!(
                    "microsoft365.tenant_id must not be empty when microsoft365 is enabled"
                );
            }
            let client = self
                .microsoft365
                .client_id
                .as_deref()
                .map(str::trim)
                .filter(|s| !s.is_empty());
            if client.is_none() {
                anyhow::bail!(
                    "microsoft365.client_id must not be empty when microsoft365 is enabled"
                );
            }
            let flow = self.microsoft365.auth_flow.trim();
            if flow != "client_credentials" && flow != "device_code" {
                anyhow::bail!("microsoft365.auth_flow must be client_credentials or device_code");
            }
            if flow == "client_credentials"
                && self
                    .microsoft365
                    .client_secret
                    .as_deref()
                    .is_none_or(|s| s.trim().is_empty())
            {
                anyhow::bail!(
                    "microsoft365.client_secret must not be empty when auth_flow is client_credentials"
                );
            }
        }

        validate_plugin_entries(&self.plugins)?;

        // MCP
        if self.mcp.enabled {

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Set auth_flow to exactly "client_credentials" (secret required) or "device_code"
2. Match on the key 'microsoft365.auth_flow' instead of message text to cover both variants
3. Delete the duplicated second block when touching this file

// Same guard as error 472:
fn m365_flow_ok(m: &zeroclaw_config::Microsoft365Config) -> bool {
    !m.enabled || matches!(m.auth_flow.trim(), "client_credentials" | "device_code")
}

if let Err(err) = config.validate() {
    if err.to_string().contains("microsoft365.auth_flow") {
        // normalize to client_credentials or device_code regardless of quoted/unquoted wording
    }
}

When it happens

Trigger: auth_flow set to any value other than exactly client_credentials or device_code on an enabled [microsoft365] section, in a build where only this second block executes.

Common situations: Comparing error text across ZeroClaw versions during upgrades; maintaining the duplicated validation code.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• microsoft365.auth_flow must be 'client_credentials' or 'devi
• microsoft365.client_secret must not be empty when auth_flow
• microsoft365.client_secret must not be empty when auth_flow
• microsoft365.tenant_id must not be empty when microsoft365 i
• microsoft365.client_id must not be empty when microsoft365 i

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/116bd8fb8ce0bad1. Report an issue: GitHub.