Hmbown/CodeWhale · error

managed external credential access is unsupported for

Error message

managed external credential access is unsupported for {}; no schema-safe preservation adapter is available

What it means

Thrown by validate_read_scope when access mode is Managed: the library recognizes the mode but has no schema-safe adapter to preserve managed credentials, so it fails loudly instead of guessing. Unlike Disabled this is a capability gap — managed access is configured but simply not implemented for reads.

Solutions

1. Upgrade to a build that implements the managed preservation adapter, if available
2. Switch the provider's access mode from "managed" to a supported mode (e.g. "read" or "disabled")
3. Remove the managed setting and manage credentials through a mechanism the library supports (e.g. direct keychain)
4. File/report the gap so managed-mode support can be added

Example fix

// before (config.toml)
[external_credentials.anthropic]
access = "managed"
// after (config.toml)
[external_credentials.anthropic]
access = "read"

let policy = load_external_credentials_policy(provider)?;
if policy.access == ExternalCredentialAccess::Managed {
    // managed mode unsupported: choose another credential source up front
}

match read_grant(provider, source, &path) {
    Err(e) if e.to_string().contains("unsupported") => use_direct_credential_source(provider),
    other => other?,
}

When it happens

Trigger: read_grant for a provider whose ExternalCredentialsPolicy.access == ExternalCredentialAccess::Managed; config written by an enterprise tool that sets "managed" mode which the current binary cannot serve.

Common situations: Newer management tooling writing a `managed` access mode consumed by an older client build; copying a managed-machine config onto a dev box.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• external credential access is disabled for
• a CNB access token is not configured in the Codewhale…
• api_key cannot be empty string
• CF_ACCOUNT_ID and CF_API_TOKEN are required
• Custom endpoint credentials for

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/64868b7e5f27601c. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/external_credentials.rs:369

    /// Validate that this record is a current read-only consent for one exact
    /// provider/source/path tuple without minting an I/O capability.
    ///
    /// This is intentionally side-effect free so inventory and picker surfaces
    /// can acknowledge dormant consent without inspecting the external file.
    pub fn validate_read_scope(
        &self,
        provider: ProviderKind,
        source: ExternalCredentialSource,
        resolved_path: &Path,
    ) -> Result<()> {
        if self.access == ExternalCredentialAccess::Disabled {
            bail!(
                "external credential access is disabled for {}",
                provider.as_str()
            );
        }
        if self.access == ExternalCredentialAccess::Managed {
            bail!(
                "managed external credential access is unsupported for {}; no schema-safe preservation adapter is available",
                provider.as_str()
            );
        }
        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
            bail!(
                "external credential consent for {} uses unsupported version {}; revoke and consent again",
                provider.as_str(),
                self.consent_version
            );
        }
        if self.provider != provider.as_str() {
            bail!(
                "external credential consent is scoped to provider {:?}, not {}",
                self.provider,
                provider.as_str()
            );
        }

View on GitHub (pinned to 73e0f67d83)