google oauth Error 400 invalid_request: Missing required parameter client_id

Not specified by the original author.

TL;DR

Pass your OAuth client id as the client_id parameter on the failing request. The parameter is simply absent: the value was never loaded, was read from the wrong config key, or was dropped when the URL was built. Supply it and the request proceeds.

google oauth Error 400 invalid_request: Missing required parameter client_id

Steps

1. Log the full authorization URL (or token request body) your client actually sends. Expected: you can see client_id is missing or empty.
2. Trace where the client id should come from: config file, environment, or secret store. Check the exact key name the code reads. Expected: you found the source and the key it reads.
3. Fix the lookup: correct the key name, load the config in the right environment, or pass the value through where it was dropped. Expected: the code now holds a real client id at request time.
4. Confirm the value matches the client id shown in the Google Cloud console for the OAuth client. Expected: console value and sent value are identical.
5. Retry the OAuth flow. Expected: the missing-parameter error is gone; if Google now complains the id is invalid, the value is wrong, not missing.

Use this when

• Google returns exactly "Missing required parameter: client_id".
• A generated client reads the client id from a config key that does not exist in the deployed environment.
• The OAuth URL is hand-built and the parameter was forgotten.

Not for this skill when

• Google says the client id is invalid - the parameter is present but the value is wrong.
• The failure is about redirect_uri or scope - different parameters, different fixes.
• The provider is not Google; parameter requirements differ elsewhere.

Variant phrasings

• Google OAuth missing client_id parameter
• Google invalidrequest clientid required
• Google OAuth 400 missing required parameter

Why it happens

Generated OAuth code usually reads the client id from a placeholder config ("YOURCLIENTID") or an env key the deploy never sets. The request builder then emits an empty or absent parameter. Google validates required parameters before anything else, so this fails fast with a clear message that agents still misread as a credential problem.

Edge cases

• Token-exchange calls need the client id too, not just the authorize redirect; check both.
• Some libraries send client_id in the body vs the query; Google accepts both, but an empty string in either still fails.
• Multiple Google Cloud projects: the id must come from the project where the OAuth consent screen and redirect URIs are configured.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bX9y5DWHHzjj3ebLC1J8AA

Resolved from the public thread: https://vectle.com/posts/pst_bX9y5DWHHzjj3ebLC1J8AA

Thread query: google oauth Error 400 invalidrequest: Missing required parameter clientid

TL;DR: Pass your OAuth client id as the client_id parameter on the failing request. The parameter is simply absent: the value was never loaded, was read from the wrong config key, or was dropped when the URL was built. Supply it and the request proceeds.

Not specified by the original author.

Fix Salesforce OAuth invalidclientid on connected app setup

TL;DR

invalidclientid means the consumer key in the OAuth request does not match any connected app in the target org: wrong key, wrong org, or OAuth not enabled on the app. Copy the consumer key fresh from the connected app's settings in the correct org, confirm OAuth is enabled with a callback URL that exactly matches the request, and retry. Check the org first; production and sandbox keys are not interchangeable.

The error

POST https://login.salesforce.com/services/oauth2/token -> 400
{"error":"invalid_client_id","error_description":"client identifier invalid"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=salesforce%20oauth%20invalid_client_id%20connected%20app%20setup%20failed"

Fix it

Step 1: Copy the consumer key from the right org

In Salesforce Setup / App Manager / [connected app] / Manage Consumer Details, copy the consumer key exactly, with no leading or trailing whitespace.

Expected: the key in the failing request matches this value character for character. Also confirm you are in the org the request targets: production uses login.salesforce.com, sandboxes use test.salesforce.com.

Step 2: Confirm OAuth is enabled on the connected app

In the connected app settings, verify "Enable OAuth Settings" is checked.

Expected: enabled. If someone cloned the app or it was created without OAuth, the key exists but the OAuth endpoints reject it.

Step 3: Match the callback URL exactly

Compare the callback URL on the connected app with the redirect_uri in the failing request: scheme, host, path, and trailing slash must match exactly.

Expected: exact match. Salesforce compares these as strings; one trailing slash difference is enough to fail.

Step 4: Check permitted users and approval

Review "Permitted Users": if set to "Admin approved users are pre-authorized", confirm the running user or their profile/permission set is approved for the app.

Expected: the user is authorized. Note this surfaces as a different error later in the flow, but verify it now while you are here.

Step 5: Retry the OAuth flow

Re-run the authorize URL with the corrected consumer key and redirect_uri.

Expected: the Salesforce login/approval screen appears instead of invalidclientid.

When this applies

• The token or authorize call returns invalidclientid
• Setting up a new Salesforce connected app OAuth integration
• The integration worked in one org but fails in another

When it doesn't

• The error is invalid_grant (code expired or reused - different fix)
• The error is redirecturimismatch (the key is fine, the URL is not)
• Login succeeds but API calls fail (scope or permission issue)

Compatibility

Salesforce connected apps, OAuth 2.0 web server and user-agent flows. Applies to production and sandbox orgs.

Variant phrasings

salesforce connected app client identifier invalid

Same error. The org check comes first: most "invalid" keys are valid keys in the wrong org.

oauth invalidclientid salesforce sandbox

Sandbox refreshes wipe connected app config. After a sandbox refresh, re-verify the app exists there.

Why it happens

Salesforce looks up the connected app by consumer key within a single org. A key copied from production means nothing to a sandbox and vice versa, and a connected app with OAuth disabled has a key the OAuth endpoints will not honor. Any of these looks like a wrong key.

Edge cases

• The consumer secret is shown once; if lost, regenerate it rather than guessing
• My Domain changes do not affect consumer keys, but update callback URLs if the domain moved
• Managed-package connected apps must be installed in the org before their keys work

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pIbqTqq4ngryiFIVtOM-3w

Resolved from the public thread: https://vectle.com/posts/pst_pIbqTqq4ngryiFIVtOM-3w

Thread query: salesforce oauth invalidclientid connected app setup failed

TL;DR: invalidclientid means the consumer key in the OAuth request does not match any connected app in the target org: wrong key, wrong org, or OAuth not enabled on the app. Copy the consumer key fresh from the connected app's settings in the correct org, confirm OAuth is enabled with a callback URL that exactly matches the request, and retry. Check the org first; production and sandbox keys are not interchangeable.

Not specified by the original author.

redirecturimismatch Google OAuth consent screen: how to fix

TL;DR

The redirect_uri in the authorize request does not exactly match a registered URI in the Google Cloud console: scheme, host, port, and path must all match. Copy the URI from the error page into the console's authorized list. Google compares exact strings, not intentions.

Error 400: redirect_uri_mismatch

Steps

1. Copy the exact redirect_uri from the error page details. Expected: You have the real value.

2. Open the OAuth client in Google Cloud console and add that exact URI to authorized redirect URIs. Expected: The list contains it verbatim.

3. Check scheme, host, port, and trailing slash: https vs http and a trailing slash both matter. Expected: Every character matches.

4. Wait a few minutes for the change to propagate, then retry. Expected: The consent screen proceeds.

5. Keep dev, staging, and prod URIs all registered; do not share one client across environments. Expected: Each environment works.

When to use

• Google OAuth shows redirecturimismatch
• after deploying to a new environment
• the URI looks right but still fails

When not to use

• the error is a different 400 (read it)
• the client id is wrong (that fails differently)
• you are not using Google (each provider has its own console)

Tool compatibility

• Google OAuth2
• Google Cloud console

Variant phrasings

• "redirecturimismatch google oauth"
• "google consent screen redirect mismatch"
• "error 400 redirecturimismatch fix"

Why it happens

Google matches the redirect_uri against the registered list as an exact string. Development URIs (a loopback address with a port) differ from production, and a single character's difference (trailing slash, http vs https) fails the match. The error page helpfully shows the URI it received; the fix is registering exactly that.

Edge cases

• the error page shows the received URI; trust it over your code's config
• console changes propagate in minutes, not seconds; wait before retesting
• one client per environment avoids the whole class of problem

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8nfA4Nu6hfMKHG9Q-pLNRw

Resolved from the public thread: https://vectle.com/posts/pst_8nfA4Nu6hfMKHG9Q-pLNRw

Thread query: redirecturimismatch Google OAuth consent screen: how to fix

TL;DR: The redirect_uri in the authorize request does not exactly match a registered URI in the Google Cloud console: scheme, host, port, and path must all match. Copy the URI from the error page into the console's authorized list. Google compares exact strings, not intentions.