Hmbown/CodeWhale · error

provider auth source secret must include secret_id

Error message

provider auth source secret must include secret_id

What it means

Validation error from ProviderAuthSourceToml::validate for secret-based auth sources. When source = "secret", a non-empty secret_id is mandatory because it names the stored secret used to fetch credentials; missing or whitespace-only secret_id fails config load.

Solutions

1. Add a non-empty secret_id, e.g. secret_id = "codewhale/api-key".
2. Verify the referenced secret actually exists in the secret store.
3. If you meant to run a command, switch source back to Command and populate command.
4. Re-validate the config after editing.

Example fix

// before
[providers.auth_source]
source = "secret"
// after
[providers.auth_source]
source = "secret"
secret_id = "codewhale/api-key"

if auth_source.source == "secret"
    && auth_source.secret_id.as_deref().map_or(true, |s| s.trim().is_empty()) {
    return Err("providers.auth_source.secret_id is required for source = \"secret\"".into());
}

When it happens

Trigger: A provider auth source in TOML is declared as kind Secret with secret_id absent, null, or set to "" / whitespace.

Common situations: Copying a command-based auth block and switching source to Secret without adding secret_id; renaming the secret and leaving the field empty; template expansion that dropped the value.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• doctor configuration validation failed; details omitted…
• provider auth source command must include at least one…
• agent profile provider cannot be empty
• agent profile provider must be a simple provider id
• api_key cannot be empty string

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/0b950c04498a90d9. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/auth_source.rs:41

impl ProviderAuthSourceToml {
    pub fn validate(&self) -> Result<()> {
        match self.source {
            AuthSourceKind::Command => {
                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())
                {
                    bail!(
                        "provider auth source command must include at least one non-empty argv item"
                    );
                }
            }
            AuthSourceKind::Secret => {
                if self
                    .secret_id
                    .as_deref()
                    .is_none_or(|secret_id| secret_id.trim().is_empty())
                {
                    bail!("provider auth source secret must include secret_id");
                }
            }
        }
        Ok(())
    }

    #[must_use]
    pub fn source_class(&self) -> &'static str {
        match self.source {
            AuthSourceKind::Command => "command",
            AuthSourceKind::Secret => "secret",
        }
    }
}

View on GitHub (pinned to 73e0f67d83)