## TL;DR

Azure AD needs client_secret in the token request body for confidential clients, and it is missing. Add it (or switch to certificate auth), keeping the secret out of logs.

## Error

```text
AADSTS7000218: The request body must contain the following parameter: client_secret
```

## Steps

1. Confirm the app is registered as a confidential client Expected: client_secret is the right fix.
2. Add client_secret to the token request body Expected: the parameter is present.
3. Retry the token request Expected: tokens are issued.
4. Store the secret in a vault, not in code or logs Expected: it stays safe.

## When to use

- AADSTS7000218 on token request
- The secret is missing from the body

## When not to use

- The app is a public client (then do not send a secret; check the app type)
- The secret is present but wrong (then the error differs)

## Tool compatibility

- Azure AD confidential clients
- Service-to-service auth

## Variant phrasings

### aadsts7000218

Add client_secret to the token request body.

### request body must contain client_secret

Same: confidential clients must send the secret.

## Why it happens

Agents copy token-request code between public and confidential clients. The parameter sets differ and Azure is strict.

## Edge cases

- Consider certificate credentials instead of secrets for production
- Secrets expire; monitor the expiry

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dZO5b3nfF7PKi2_4QC1OzA