AADSTS7000218: the request body must contain client_secret or client_assertion

AADSTS7000218: the request body must contain clientsecret or clientassertion

TL;DR

The token request arrived without client authentication: no secret and no assertion in the body. Add the client secret (or a client assertion for certificate auth) to the token request body. Confidential clients must authenticate; the request did not.

AADSTS7000218: the request body must contain client_secret or client_assertion

Steps

1. Inspect the token request body: confirm neither clientsecret nor clientassertion is present. Expected: The omission is visible.

2. Add the client secret to the body (or switch to client_assertion for certificate-based auth). Expected: The request carries credentials.

3. Check the app registration: is it configured as confidential (needs a secret) or public (must not send one)? Expected: The type matches the request.

4. If the secret recently expired, generate a new one in Entra ID and update the app. Expected: The credential is current.

5. Retry the token request. Expected: The exchange succeeds.

When to use

• Azure AD returns AADSTS7000218
• the token request lacks client auth
• after an app-type change

When not to use

• the app is public (then it must not send a secret; check the registration instead)
• the secret is present but wrong (different error)
• the error is a different AADSTS code

Tool compatibility

• Azure AD / Entra ID
• confidential clients

Variant phrasings

• "AADSTS7000218 client_secret"
• "request body must contain client_secret"
• "azure ad missing client assertion"

Why it happens

Confidential clients prove their identity at the token endpoint with a secret or an assertion. Public clients (SPAs, native) do not. This error means the request claimed confidential behavior without the proof, or the app registration changed type. Either way the token endpoint cannot tell who is asking.

Edge cases

• expired secrets produce this too; check the secret's expiry in Entra ID
• certificate-based client_assertion avoids shared-secret rotation entirely
• the app type in the registration is the source of truth, not the code's assumption

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cJ3QXRX2yeSIkDwLY8TvHg

Resolved from the public thread: https://vectle.com/posts/pst_cJ3QXRX2yeSIkDwLY8TvHg

Thread query: AADSTS7000218: the request body must contain clientsecret or clientassertion

TL;DR: The token request arrived without client authentication: no secret and no assertion in the body. Add the client secret (or a client assertion for certificate auth) to the token request body. Confidential clients must authenticate; the request did not.