Hmbown/CodeWhale · error

external credential consent for

Error message

external credential consent for {} uses unsupported version {}; revoke and consent again

What it means

Thrown by validate_read_scope when the stored consent_version for a provider does not match EXTERNAL_CREDENTIAL_CONSENT_VERSION: the user consented to external credential access under an older (or newer) consent schema that this build will not honor. The message instructs revoking and re-consenting so the grant is re-established under the current terms.

Solutions

  1. Revoke external credential access for the provider and re-run the consent flow to record the current version
  2. Upgrade or align the application version with the one that wrote the consent record
  3. Edit the stored consent_version to the current EXTERNAL_CREDENTIAL_CONSENT_VERSION only via the official consent flow (never by hand-editing)
  4. Reset the external-credentials section of config.toml and set it up again

Example fix

// before (config.toml)
[external_credentials.openai]
consent_version = 1
// after: re-run consent; tooling writes
[external_credentials.openai]
consent_version = 2
Defensive patterns

Strategy: try-catch

Validate before calling

// Compare stored consent version before reading
let policy = load_external_credentials_policy(provider)?;
if policy.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
    // trigger revoke + re-consent flow instead of read_grant
}

Try / catch

match read_grant(provider, source, &path) {
    Err(e) if e.to_string().contains("unsupported version") => {
        revoke_consent(provider)?;
        run_consent_flow(provider)?;
        read_grant(provider, source, &path)?
    }
    other => other?,
}

Prevention

When it happens

Trigger: read_grant after the application updated EXTERNAL_CREDENTIAL_CONSENT_VERSION but the persisted policy still carries the old version; restoring a config backup from an older release; downgrading the binary against a newer consent record.

Common situations: Upgrading the app where the consent schema changed; syncing config files across machines running different versions.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/ab013bf73f19c811. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/external_credentials.rs:375

        &self,
        provider: ProviderKind,
        source: ExternalCredentialSource,
        resolved_path: &Path,
    ) -> Result<()> {
        if self.access == ExternalCredentialAccess::Disabled {
            bail!(
                "external credential access is disabled for {}",
                provider.as_str()
            );
        }
        if self.access == ExternalCredentialAccess::Managed {
            bail!(
                "managed external credential access is unsupported for {}; no schema-safe preservation adapter is available",
                provider.as_str()
            );
        }
        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
            bail!(
                "external credential consent for {} uses unsupported version {}; revoke and consent again",
                provider.as_str(),
                self.consent_version
            );
        }
        if self.provider != provider.as_str() {
            bail!(
                "external credential consent is scoped to provider {:?}, not {}",
                self.provider,
                provider.as_str()
            );
        }
        if self.source != source {
            bail!(
                "external credential consent source mismatch for {} (expected {})",
                provider.as_str(),
                source.as_str()
            );

View on GitHub (pinned to 73e0f67d83)