Hmbown/CodeWhale · error · anyhow::Error

external credential consent for {} uses unsupported version

Error message

external credential consent for {} uses unsupported version {}; revoke and consent again

What it means

Each stored consent is stamped with EXTERNAL_CREDENTIAL_CONSENT_VERSION (currently 1); validate_read_scope() refuses to honor a record whose version differs, because the consent semantics may have changed between versions. The correct recovery — named in the message — is to revoke the old consent and consent again under the current version.

Source

Thrown at crates/config/src/external_credentials.rs:414

        &self,
        provider: ProviderKind,
        source: ExternalCredentialSource,
        resolved_path: &Path,
    ) -> Result<()> {
        if self.access == ExternalCredentialAccess::Disabled {
            bail!(
                "external credential access is disabled for {}",
                provider.as_str()
            );
        }
        if self.access == ExternalCredentialAccess::Managed {
            bail!(
                "managed external credential access is unsupported for {}; no schema-safe preservation adapter is available",
                provider.as_str()
            );
        }
        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
            bail!(
                "external credential consent for {} uses unsupported version {}; revoke and consent again",
                provider.as_str(),
                self.consent_version
            );
        }
        if self.provider != provider.as_str() {
            bail!(
                "external credential consent is scoped to provider {:?}, not {}",
                self.provider,
                provider.as_str()
            );
        }
        if self.source != source {
            bail!(
                "external credential consent source mismatch for {} (expected {})",
                provider.as_str(),
                source.as_str()
            );

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Revoke the stale consent and consent again with the current Codewhale version
2. If it came from a backup restore, expect one-time re-consent per credential
3. Keep consent records out of config backups/sync so version skew cannot follow you between machines

Example fix

# before: consent_version = 0 (from an older build)

# after
$ codewhale credentials revoke <provider>
$ codewhale credentials consent <provider> --source path --path /keys/acme.env
# re-creates the record with consent_version = 1

if consent.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
    // flag as stale and route to revoke + re-consent before any read
}

fn consent_version_is_current(c: &ExternalCredentialConsent) -> bool {
    c.consent_version == EXTERNAL_CREDENTIAL_CONSENT_VERSION
}

match consent.validate_read_scope(provider, source, &path) {
    Ok(()) => read_external_credential(&path),
    Err(e) if e.to_string().contains("unsupported version") => {
        revoke_and_reconsent(provider).await // the documented recovery
    }
    Err(e) => Err(e),
}

When it happens

Trigger: A consent record in config carries consent_version != 1 (e.g. 0 from an earlier Codewhale, or 2 from a newer one) and is validated for use.

Common situations: Downgrading Codewhale after a consent created by a newer version; consent files written by pre-release/experimental builds; hand-editing or restoring an old config backup that carries stale consent records.

Related errors

• external credential path escapes its absolute root: {}
• external credential access is disabled for {}
• managed external credential access is unsupported for {}; no
• external credential consent is scoped to provider {:?}, not
• external credential consent source mismatch for {} (expected

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/ab013bf73f19c811. Report an issue: GitHub.