zeroclaw-labs/zeroclaw · error

microsoft365.client_secret must not be empty when auth_flow

Error message

microsoft365.client_secret must not be empty when auth_flow is client_credentials

What it means

Second copy of the client_secret guard (schema.rs:21755-21765): when trimmed auth_flow is client_credentials, client_secret must be present and non-whitespace. Identical to error 473 except the message omits quotes around the flow name; the first validation block shadows it in current builds. Same fix applies regardless of which variant fires.

Source

Thrown at crates/zeroclaw-config/src/schema.rs:21762

                .map(str::trim)
                .filter(|s| !s.is_empty());
            if client.is_none() {
                anyhow::bail!(
                    "microsoft365.client_id must not be empty when microsoft365 is enabled"
                );
            }
            let flow = self.microsoft365.auth_flow.trim();
            if flow != "client_credentials" && flow != "device_code" {
                anyhow::bail!("microsoft365.auth_flow must be client_credentials or device_code");
            }
            if flow == "client_credentials"
                && self
                    .microsoft365
                    .client_secret
                    .as_deref()
                    .is_none_or(|s| s.trim().is_empty())
            {
                anyhow::bail!(
                    "microsoft365.client_secret must not be empty when auth_flow is client_credentials"
                );
            }
        }

        validate_plugin_entries(&self.plugins)?;

        // MCP
        if self.mcp.enabled {
            validate_mcp_config(&self.mcp)?;
        }

        // Knowledge graph
        if self.knowledge.enabled {
            if self.knowledge.max_nodes == 0 {
                validation_bail!(
                    InvalidNumericRange,
                    "knowledge.max_nodes",

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Set a non-empty microsoft365.client_secret, or switch to device_code flow
2. Key automated handling on 'microsoft365.client_secret', not the message string
3. Remove the duplicated block when maintaining this file

// Same guard as error 473:
fn m365_secret_ok(m: &zeroclaw_config::Microsoft365Config) -> bool {
    m.auth_flow.trim() != "client_credentials"
        || m.client_secret.as_deref().map(str::trim).is_some_and(|s| !s.is_empty())
}

if let Err(err) = config.validate() {
    if err.to_string().contains("microsoft365.client_secret") {
        // inject the secret or switch flows — covers both wording variants
    }
}

When it happens

Trigger: auth_flow = "client_credentials" with client_secret missing/blank on an enabled [microsoft365] section, in a build where the second block is the effective one.

Common situations: Version-skewed log analysis; review of the duplicated block.

Related errors

• microsoft365.client_secret must not be empty when auth_flow
• microsoft365.auth_flow must be client_credentials or device_
• microsoft365.tenant_id must not be empty when microsoft365 i
• microsoft365.client_id must not be empty when microsoft365 i
• microsoft365.auth_flow must be 'client_credentials' or 'devi

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/629d4a26e92ef76d. Report an issue: GitHub.