AADSTS7000215: Invalid client secret is provided

Question

We are integrating with client's SharePoint using SharePoint REST API. For this, the client has registered an add-in at their side using the appregnew.aspx and provided permissions to the Add in using appinv.aspx.

Now when I am trying to get the bearer token for using the tenant id and giving all other parameters in request body, I am getting the following error:

 "error": "invalid_client",
 "error_description": "AADSTS7000215: Invalid client secret is provided.\r\nTrace ID: 993e6c16 
  -68f3-4105-baf5-b08368de0700\r\nCorrelation ID: 59a5e402-1583-422b-8b62- 
    03b620eb72c1\r\nTimestamp: 2020-06-04 06:34:01Z"

The error message says the client secret is invalid but it is the same client secret that we got from the appregnew.aspx. Can someone help me with this error?

I am using postman to hit the URL and using the application/x-www-form-urlencoded for request body.

Answer 1

You might have copied the secret improperly. Easiest way to test a client id/secret is using PnP:

Connect-PnPOnline -Url https://contoso.sharepoint.com -AppId 344b8aab-389c-4e4a-8fa1-4c1ae2c0a60d -AppSecret a3f3faf33f3awf3a3sfs3f3ss3f4f4a3fawfas3ffsrrffssfd

You'll get an error if the combo is not valid. If the PnP Command works, but your Postman fails, then there's something wrong with your credential flow (although it seems to look OK to me).

It's possible the client secret was revoked. You can confirm this by going into Azure AD and finding your app under Enterprise Applications. You won't see the actual secret but you will see if one exists. You can also generate new secrets from here if you need to (assuming you have the right permissions)

Answer 2

I know this is an old thread, I had the same issue. After a long night of searching I found the problem. It seems that if you have a + char in your key, it should be replaced with "%2B"

I found the answer at the following link: https://www.outsystems.com/forums/discussion/53348/sharepoint-postoauth-error-invalid-client-secret-is-provided/

https://www.outsystems.com/forums/discussion/22572/outsystems-encoding-issue-in-restapi-content-type-application-x-www-form-urlenco/

Answer 3

Make sure you escape special characters (+,=, etc.) before sending the credentials.

For JavaScript, you can use encodeURIComponent() to do so.