What causes "Invalid provider type: ${args.type}" in anomalyco/sst?

Use one of the supported provider values: 'google', 'facebook', 'amazon', or 'apple'.

anomalyco/sst · error · VisibleError

Invalid provider type: ${args.type}

Error message

Invalid provider type: ${args.type}

What it means

Cognito Identity Provider supports a fixed set of provider types (Google, Facebook, LoginWithAmazon, SignInWithApple, plus OIDC/SAML). SST maps its args.provider string to the AWS type; if the mapping yields nothing the value was misspelled or unsupported, so it throws.

Source

Thrown at platform/src/components/aws/cognito-identity-provider.ts:52

    const providerType = normalizeProviderType();
    const identityProvider = createIdentityProvider();

    this.identityProvider = identityProvider;

    function normalizeProviderType() {
      const type = output(args.type).apply(
        (type) =>
          ({
            saml: "SAML",
            oidc: "OIDC",
            facebook: "Facebook",
            google: "Google",
            amazon: "LoginWithAmazon",
            apple: "SignInWithApple",
          })[type],
      );
      if (!type) throw new VisibleError(`Invalid provider type: ${args.type}`);
      return type;
    }

    function createIdentityProvider() {
      return new cognito.IdentityProvider(
        ...transform(
          args.transform?.identityProvider,
          `${name}IdentityProvider`,
          {
            userPoolId: args.userPool,
            providerName: name,
            providerType,
            providerDetails: args.details,
            attributeMapping: args.attributes,
          },
          { parent },
        ),
      );

View on GitHub (pinned to a0bd20f762)

Solutions

Use one of the supported provider values: 'google', 'facebook', 'amazon', or 'apple'.
Check spelling/casing of args.provider against the SST CognitoIdentityProvider docs.
For unsupported IdPs like GitHub, set up a generic OIDC provider in Cognito instead of this component.

Example fix

// before
new sst.aws.CognitoIdentityProvider('Google', { userPool, provider: 'Google' });
// after
new sst.aws.CognitoIdentityProvider('Google', { userPool, provider: 'google', ... });

Defensive patterns

Strategy: validation

Validate before calling

const SUPPORTED = ['google', 'facebook', 'amazon', 'apple'];
function validateProvider(provider) {
  if (!SUPPORTED.includes(provider))
    throw new Error(`Unsupported provider: ${provider}. Use one of ${SUPPORTED.join(', ')}`);
}
validateProvider(args.provider);

Type guard

const isSupportedProvider = (p) => ['google','facebook','amazon','apple'].includes(p);

Prevention

Use lowercase literal provider names from the SST docs.
For GitHub/other IdPs, use Cognito's OIDC provider path instead.
Centralize the provider name in a constant with a union type.

When it happens

Trigger: new sst.aws.CognitoIdentityProvider('X', { provider: 'github', userPool }) where args.provider doesn't match a known key in normalizeProviderType.

Common situations: Typos ('Google' vs 'google', 'apple' vs 'signInWithApple'); attempting GitHub OAuth (not natively supported by Cognito — needs OIDC); copying provider names from other platforms.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/dcc2e475e8ee434c. Report an issue: GitHub.