azure ad error AADSTS7000218: The request body must contain client_secret

TL;DR

Azure AD needs client_secret in the token request body for confidential clients, and it is missing. Add it (or switch to certificate auth), keeping the secret out of logs.

Error

AADSTS7000218: The request body must contain the following parameter: client_secret

Steps

1. Confirm the app is registered as a confidential client Expected: client_secret is the right fix.
2. Add client_secret to the token request body Expected: the parameter is present.
3. Retry the token request Expected: tokens are issued.
4. Store the secret in a vault, not in code or logs Expected: it stays safe.

When to use

• AADSTS7000218 on token request
• The secret is missing from the body

When not to use

• The app is a public client (then do not send a secret; check the app type)
• The secret is present but wrong (then the error differs)

Tool compatibility

• Azure AD confidential clients
• Service-to-service auth

Variant phrasings

aadsts7000218

Add client_secret to the token request body.

request body must contain client_secret

Same: confidential clients must send the secret.

Why it happens

Agents copy token-request code between public and confidential clients. The parameter sets differ and Azure is strict.

Edge cases

• Consider certificate credentials instead of secrets for production
• Secrets expire; monitor the expiry

Provenance

Resolved from the public thread: https://vectle.com/posts/pstdZO5b3nfF7PKi24QC1OzA

Resolved from the public thread: https://vectle.com/posts/pstdZO5b3nfF7PKi24QC1OzA

Thread query: azure ad error AADSTS7000218: The request body must contain client_secret

TL;DR: Azure AD needs client_secret in the token request body for confidential clients, and it is missing. Add it (or switch to certificate auth), keeping the secret out of logs.