Hmbown/CodeWhale · error

managed external credential access is unsupported in v0.9.1:

Error message

managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage.

What it means

The external-credentials command supports a `--mode` argument, and `managed` mode is intentionally unshipped in v0.9.1: no provider has a reviewed schema-safe adapter that could preserve external credential files while managing them. After printing the consent preview, Codewhale refuses to continue in managed mode and tells you the two supported alternatives: `--mode read-only` or Codewhale-owned login/API-key storage.

Source

Thrown at crates/cli/src/lib.rs:3741

                0
            } else {
                1
            })
        }
        AuthCommand::ExternalConsent {
            provider,
            mode,
            path,
            yes,
        } => {
            let provider: ProviderKind = provider.into();
            let (source, path) = external_credential_target(provider, path)?;
            let preview = external_consent_preview_lines(provider, source, &path);
            for line in &preview {
                println!("{line}");
            }
            if mode == ExternalCredentialModeArg::Managed {
                bail!(
                    "managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage."
                );
            }
            confirm_external_consent(yes)?;
            let path_value = path.to_str().context(
                "external credential path cannot be persisted losslessly because it is not valid UTF-8",
            )?;
            let provider_key = provider.provider().provider_config_key();
            codewhale_config::mutate_config_document(store.path(), |document| {
                if matches!(provider, ProviderKind::OpenaiCodex | ProviderKind::Xai) {
                    codewhale_config::set_config_document_value(
                        document,
                        &["providers", provider_key, "auth_mode"],
                        "oauth",
                    )?;
                }
                let prefix = &["providers", provider_key, "external_credentials"];
                codewhale_config::set_config_document_value(

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Re-run with `--mode read-only` for read-only access to the external credential file
2. Prefer Codewhale-owned storage: `codewhale auth login` or API-key config so Codewhale manages credentials natively
3. Watch release notes — managed mode requires a reviewed preservation adapter per provider before it ships

Example fix

# before
$ codewhale external-credentials --provider grok --mode managed
# managed external credential access is unsupported in v0.9.1...

# after
$ codewhale external-credentials --provider grok --mode read-only --yes

#!/usr/bin/env bash
mode="read-only"   # never request 'managed' on v0.9.x
codewhale external-credentials --provider grok --mode "$mode" --yes

When it happens

Trigger: Explicitly passing `--mode managed` to the external-credentials command for any provider; UIs or scripts written against a planned managed-mode contract.

Common situations: Users expecting Codewhale to maintain/refresh external CLI credentials (rotate, keep schemas in sync) rather than just read them; documentation or muscle memory from a tool where managed credential takeover exists.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• API key must be {MIN_API_KEY_BYTES}-{MAX_API_KEY_BYTES} UTF-
• credential handoff could not write to stdout
• {} has no supported external CLI credential source
• external credential consent was not saved: non-interactive u
• external credential path escapes its absolute root: {}

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/2940df9ff2adcb9c. Report an issue: GitHub.