> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onyx.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Client secret authentication

> Register a SharePoint application that authenticates with a client secret, the simplest way to index content

A client secret is a password Microsoft generates for your Entra application.
It is the quickest way to get the SharePoint connector indexing,
and the right choice when every indexed document can share one access level in Onyx.

A client secret cannot be used for permission sync:
SharePoint will not release its permission data to an application that signed in with a secret,
whatever permissions you grant it. If you need Onyx to mirror who can see what in SharePoint,
set up [certificate authentication](/admins/connectors/official/sharepoint/certificate) instead.

## Register the application

<Steps>
  <Step title="Open App registrations">
    Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/)
    or the [Azure portal](https://portal.azure.com/) and go to **App registrations**.
  </Step>

  <Step title="Create the registration">
    Select **New registration**. Name it something recognizable, such as `Onyx SharePoint Connector`.
    Leave the supported account types and redirect URI at their defaults. Select **Register**.
  </Step>

  <Step title="Record the two IDs">
    On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
  </Step>
</Steps>

## Create the client secret

<Steps>
  <Step title="Open Certificates & secrets">
    In your app registration, go to **Certificates & secrets → Client secrets**.
  </Step>

  <Step title="Add a secret">
    Select **New client secret**, give it a description, and choose an expiry. Microsoft allows up to 24 months.
    Select **Add**.
  </Step>

  <Step title="Copy the value immediately">
    Copy the **Value** column, not the **Secret ID**. The value is shown only while you stay on this page.
    Once you navigate away you cannot get it back, and you have to create a new secret.
  </Step>
</Steps>

## Grant permissions

<Steps>
  <Step title="Add the Microsoft Graph permission">
    Go to **API permissions → Add a permission → Microsoft Graph → Application permissions**, and add `Sites.Read.All`.
    This lets the application read your sites, document libraries, files, and pages.
  </Step>

  <Step title="Consider narrowing the scope">
    `Sites.Read.All` lets the app read every site in your tenant, even if the connector indexes only one.
    If that is too broad, add `Sites.Selected` instead and authorize the app one site at a time.
    The connector's **Sites** configuration can no longer be left empty in Onyx.

    See [Limiting the app to specific
    sites](/admins/connectors/official/sharepoint/sharepoint#limiting-the-app-to-specific-sites) for the procedure.
  </Step>

  <Step title="Grant admin consent">
    Select **Grant admin consent for \<your organization>** and confirm. The permission should then show **Granted**.
    Until you do this, it does not take effect.

    This step needs the **Global Administrator** or **Privileged Role Administrator** role.
    No other role can consent to Microsoft Graph application permissions,
    so if the button is unavailable or consent fails, ask someone with one of those roles to do it.
  </Step>
</Steps>

<Info>
  A new registration already lists a delegated `User.Read` permission. The connector never uses it.
  Leave it or remove it, as you prefer.
</Info>

## Add the credential to Onyx

<Steps>
  <Step title="Open the SharePoint connector">
    In Onyx, go to **Admin Panel → Add Connector** and select **SharePoint**.
  </Step>

  <Step title="Create a client secret credential">
    Select **Create New**, then the **Client Secret** tab, and enter:

    * **Application (client) ID**, from the app registration Overview page
    * **Directory (tenant) ID**, from the same page
    * **Client Secret**: the secret **Value** you copied
  </Step>

  <Step title="Save and continue">
    Select **Create**, confirm the new credential is selected,
    and continue to the connector settings described in [Configure the connector in
    Onyx](/admins/connectors/official/sharepoint/sharepoint#configure-the-connector-in-onyx).
  </Step>
</Steps>

## Rotating the secret

Indexing stops when the secret expires. To rotate without downtime:

<Steps>
  <Step title="Create a second secret">
    In **Certificates & secrets**, add a new client secret and copy its value. Entra holds more than one at a time,
    and both work until the old one expires.
  </Step>

  <Step title="Update the credential in Onyx">
    In **Admin Panel → Existing Connectors**, open the connector's credential and replace the secret value.
  </Step>

  <Step title="Delete the old secret">
    Once an indexing attempt has succeeded, delete the previous secret in Entra.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="invalid_client">
    The secret is wrong or expired. Check that you copied the secret **Value** rather than the **Secret ID**,
    and that it has not passed its expiry date.
  </Accordion>

  <Accordion title="Unsupported app only token">
    Permission sync is on, and it cannot work with a client secret.
    Rebuild the credential with a [certificate](/admins/connectors/official/sharepoint/certificate).
  </Accordion>

  <Accordion title="Nothing is indexed, and Sites is empty">
    Indexing your whole tenant needs `Sites.Read.All`. Under `Sites.Selected`, list your sites explicitly.
  </Accordion>

  <Accordion title="Nothing is indexed, and Sites is populated">
    Under `Sites.Selected`, each site must also be granted to the app. Consent alone grants nothing.
  </Accordion>

  <Accordion title="Permissions show as not granted">
    Admin consent was never given, or was given before you added the last permission.
    Select **Grant admin consent** again.
  </Accordion>

  <Accordion title="Indexing worked, then stopped on a fixed date">
    The secret expired. See [Rotating the secret](#rotating-the-secret).
  </Accordion>
</AccordionGroup>

For problems with sites, scoping, file types, and content,
see [Troubleshooting](/admins/connectors/official/sharepoint/sharepoint#troubleshooting) on the overview page.