Significant-Gravitas/AutoGPT · error · HTTPException

Provider-runtime credentials cannot be created directly

Error message

Provider-runtime credentials cannot be created directly

What it means

POST /integrations/{provider}/credentials returns 400 'Provider-runtime credentials cannot be created directly' when the payload is an OAuth2 credential with refresh_strategy == 'provider_runtime'. Such credentials only materialize tokens at call time against the provider's runtime, so they cannot be constructed by clients; they are minted internally by the platform.

Source

Thrown at autogpt_platform/backend/backend/api/features/integrations/router.py:584

        ProviderName, Path(title="The provider to create credentials for")
    ],
    credentials: Credentials,
) -> CredentialsMetaResponse:
    if is_sdk_default(credentials.id):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Cannot create credentials with a reserved ID",
        )
    if provider == ProviderName.CODEX:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Codex credentials must be created through ChatGPT sign-in",
        )
    if (
        isinstance(credentials, OAuth2Credentials)
        and credentials.refresh_strategy == "provider_runtime"
    ):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Provider-runtime credentials cannot be created directly",
        )
    credentials.provider = provider
    try:
        await creds_manager.create(user_id, credentials)
    except Exception:
        logger.exception("Failed to store credentials")
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="Failed to store credentials",
        )
    return to_meta_response(credentials)


class CredentialsDeletionResponse(BaseModel):
    deleted: Literal[True] = True
    revoked: bool | None = Field(

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Drop refresh_strategy from the payload (defaults apply) or set the standard strategy for client-created OAuth2 creds
2. If you genuinely need provider_runtime behavior, use the platform flow that creates it internally — not this endpoint

Example fix

// before
{"type": "oauth2", "refresh_strategy": "provider_runtime", ...}

// after
{"type": "oauth2", ...}  // standard refresh strategy

payload.pop('refresh_strategy', None)  # never send provider_runtime to the create endpoint

When it happens

Trigger: POST credentials with {"type": "oauth2", "refresh_strategy": "provider_runtime", ...}.

Common situations: Client copies an internal credential shape from logs/docs; migration script re-imports exported credentials verbatim including the internal refresh strategy.

Related errors

• Picker tokens are only available for OAuth2 credentials
• Credential has no access token; reconnect the account
• OAuth2 callback failed to exchange code for tokens: {str(e)}
• Credential does not grant any scope eligible for the picker.
• Codex credentials must be created through ChatGPT sign-in

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/177e26c5386a018c. Report an issue: GitHub.