Significant-Gravitas/AutoGPT · error · HTTPException

Picker tokens are not available for provider '{provider.valu

Error message

Picker tokens are not available for provider '{provider.value}'

What it means

The picker-token endpoint returns 400 "Picker tokens are not available for provider '{provider}'" when the provider is not in _PICKER_TOKEN_ALLOWED_SCOPES. Currently only ProviderName.GOOGLE is allow-listed; the check exists so this bearer-token-minting endpoint cannot be abused for unrelated OAuth integrations (e.g. GitHub).

Source

Thrown at autogpt_platform/backend/backend/api/features/integrations/router.py:542

        )
    if not isinstance(credential, OAuth2Credentials):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Picker tokens are only available for OAuth2 credentials",
        )
    if not credential.access_token:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Credential has no access token; reconnect the account",
        )

    # Gate on provider+scope: only credentials that actually grant access to
    # a provider-hosted picker flow may mint a token through this endpoint.
    # Prevents using this path to extract bearer tokens for unrelated OAuth
    # integrations (e.g. GitHub) that happen to be stored under the same user.
    allowed_scopes = _PICKER_TOKEN_ALLOWED_SCOPES.get(provider)
    if not allowed_scopes:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=(f"Picker tokens are not available for provider '{provider.value}'"),
        )
    cred_scopes = set(credential.scopes or [])
    if cred_scopes.isdisjoint(allowed_scopes):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=(
                "Credential does not grant any scope eligible for the picker. "
                "Reconnect with the appropriate scope."
            ),
        )

    return PickerTokenResponse(
        access_token=credential.access_token.get_secret_value(),
        access_token_expires_at=credential.access_token_expires_at,
    )

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Only call picker-token for google; for other providers this endpoint is intentionally unavailable
2. If you genuinely need a new provider-hosted picker, add the provider and its picker scopes to _PICKER_TOKEN_ALLOWED_SCOPES in router.py and ship a backend change — it is a deliberate security gate

PICKER_PROVIDERS = {'google'}
if provider not in PICKER_PROVIDERS:
    raise ValueError(f'no picker support for {provider}')

const isPickerProvider = (p: string): boolean => p === 'google';

When it happens

Trigger: POST /integrations/github/credentials/<id>/picker-token, or any picker-token call whose path provider is not 'google'.

Common situations: Generic client code tries the picker-token endpoint for every provider; a new provider-hosted picker was added frontend-side without allow-listing it backend-side.

Related errors

• url must point at a trusted frontend origin.
• Picker tokens are only available for OAuth2 credentials
• Credential has no access token; reconnect the account
• Credential does not grant any scope eligible for the picker.
• Username mismatch: authenticated as a different user

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/0bb58d5b916dc62f. Report an issue: GitHub.