Hmbown/CodeWhale · error · anyhow::Error

provider auth source secret must include secret_id

Error message

provider auth source secret must include secret_id

What it means

Config validation: a provider auth block declared source = "secret" must name the secret via `secret_id`. ProviderAuthSourceToml::validate() bails when secret_id is missing, None, or trims to empty. It exists so a secret-backed provider can never be constructed without an identifier to look up.

Source

Thrown at crates/config/src/auth_source.rs:41

impl ProviderAuthSourceToml {
    pub fn validate(&self) -> Result<()> {
        match self.source {
            AuthSourceKind::Command => {
                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())
                {
                    bail!(
                        "provider auth source command must include at least one non-empty argv item"
                    );
                }
            }
            AuthSourceKind::Secret => {
                if self
                    .secret_id
                    .as_deref()
                    .is_none_or(|secret_id| secret_id.trim().is_empty())
                {
                    bail!("provider auth source secret must include secret_id");
                }
            }
        }
        Ok(())
    }

    #[must_use]
    pub fn source_class(&self) -> &'static str {
        match self.source {
            AuthSourceKind::Command => "command",
            AuthSourceKind::Secret => "secret",
        }
    }
}

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Add the identifier: secret_id = "<name-of-secret-in-store>" under the same auth table
2. If you actually wanted command-based auth, set source = "command" with a valid command argv
3. Verify the secret_id matches an entry your secret backend can resolve before restarting

Example fix

# before
[providers.acme.auth]
source = "secret"

# after
[providers.acme.auth]
source = "secret"
secret_id = "acme-api-key"

if matches!(auth.source, AuthSourceKind::Secret)
    && auth.secret_id.as_deref().is_none_or(|s| s.trim().is_empty())
{
    anyhow::bail!("fix config: secret auth needs secret_id");
}

match cfg.validate() {
    Ok(()) => { /* safe to start */ }
    Err(e) if e.to_string().contains("must include secret_id") => {
        show_config_hint("secret_id = \"<name>\"");
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: In config.toml, an auth table with source = "secret" but no secret_id key, secret_id = "", or secret_id = " " (whitespace only).

Common situations: Migrating a provider from command auth to secret auth and forgetting the identifier; typo'd key name (secret-id vs secret_id); assuming the secret is discovered from the provider name automatically.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• provider auth source command must include at least one non-e
• context_window must be greater than 0
• custom provider '{provider_id}' must set [providers.{provide
• Invalid transcript.prose_measure: {detail}.
• agent profile {} model must be a visible model id without wh

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/0b950c04498a90d9. Report an issue: GitHub.