{"record":{"id":"02f9b2bc457a8d00","repo":"coleam00/Archon","slug":"pi-auth-no-credentials-for-provider-parsed-pro","errorCode":null,"errorMessage":"Pi auth: no credentials for provider '${parsed.provider}'. ${envHint} ${loginHint}","messagePattern":"Pi auth: no credentials for provider '(.+?)'\\. (.+?) (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/providers/src/community/pi/provider.ts","lineNumber":564,"sourceCode":"      // We only need the apiKey for the Anthropic subscription-OAuth shape\n      // discriminator in step 4c — the SDK reads the credential on its own\n      // when sending.\n      const resolution = await modelRuntime.getAuth(parsed.provider);\n      resolvedKey = resolution?.auth.apiKey;\n      hasResolvedAuth = Boolean(resolvedKey);\n    }\n    if (model) {\n      if (!hasResolvedAuth) {\n        if (envVarName) {\n          // Name the OAuth var first when the backend has one — a subscription\n          // user who hits this miss must be told the var the resolver actually\n          // prefers (ANTHROPIC_OAUTH_TOKEN), not just the API-key var (#1984).\n          const varHint = oauthVarName\n            ? `${oauthVarName} (subscription) or ${envVarName}`\n            : envVarName;\n          const envHint = `Set ${varHint} in the environment or codebase env vars (.archon/config.yaml env: section).`;\n          const loginHint = `Or run \\`pi\\` and type \\`/login\\` locally to authenticate '${parsed.provider}' via OAuth; credentials land in ~/.pi/agent/auth.json and are picked up automatically.`;\n          throw new Error(\n            `Pi auth: no credentials for provider '${parsed.provider}'. ${envHint} ${loginHint}`\n          );\n        }\n\n        // Unmapped providers (LM Studio, ollama, llamacpp, custom\n        // OpenAI-compatible endpoints) often don't need credentials at all —\n        // log + continue rather than failing fast so local models work without\n        // ceremony. If the SDK call later fails for a provider that *does*\n        // need creds, the auth_missing breadcrumb is searchable in the log.\n        getLog().info(\n          {\n            piProvider: parsed.provider,\n            envHint: `Provider '${parsed.provider}' is not in the Archon adapter's env-var table — file an issue if you want a shortcut env var for it.`,\n            loginHint: `Or run \\`pi\\` and type \\`/login\\` locally to authenticate '${parsed.provider}' via OAuth; credentials land in ~/.pi/agent/auth.json and are picked up automatically.`,\n          },\n          'pi.auth_missing'\n        );\n      }","sourceCodeStart":546,"sourceCodeEnd":582,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/providers/src/community/pi/provider.ts#L546-L582","documentation":"The Pi session requires credentials for the parsed provider (e.g. anthropic, openai). sendQuery found no auth entry in the Pi auth storage and no matching environment variable, so it throws with a hint naming the env var(s) for that provider (including OAuth-subscription vars like ANTHROPIC_OAUTH_TOKEN) and the `pi /login` fallback.","triggerScenarios":"sendQuery for a provider that needs credentials when auth.json has no entry for parsed.provider and the provider's env var (or codebase env vars from .archon/config.yaml env:) is unset.","commonSituations":"CI without secrets exported, API keys present but under the wrong variable name (e.g. ANTHROPIC_API_KEY set but the code path wants ANTHROPIC_OAUTH_TOKEN for subscriptions), or the key stored for a different provider id than the model ref uses.","solutions":["Export the provider's env var named in the message (or add it under env: in .archon/config.yaml)","For a Claude subscription, set ANTHROPIC_OAUTH_TOKEN rather than only ANTHROPIC_API_KEY","Run `pi` and `/login` so OAuth credentials land in ~/.pi/agent/auth.json","Verify the model ref's provider id matches the provider the credentials are stored under"],"exampleFix":"// before\n$ archon run workflow   # ANTHROPIC_OAUTH_TOKEN unset\n// after\n$ export ANTHROPIC_OAUTH_TOKEN=sk-ant-oat...\n$ archon run workflow","handlingStrategy":"validation","validationCode":"import { readFileSync, existsSync } from 'node:fs';\nfunction piHasCredentials(provider: string): boolean {\n  const envVars: Record<string, string> = {\n    anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY', google: 'GEMINI_API_KEY',\n  };\n  if (envVars[provider] && process.env[envVars[provider]]) return true;\n  const authPath = `${process.env.HOME}/.pi/agent/auth.json`;\n  try {\n    const auth = JSON.parse(readFileSync(authPath, 'utf8'));\n    return Boolean(auth[provider]);\n  } catch { return false; }\n}","typeGuard":"function hasEnvCredentials(varNames: string[]): boolean {\n  return varNames.some(v => typeof process.env[v] === 'string' && process.env[v]!.length > 0);\n}","tryCatchPattern":"try {\n  await sendQuery(q);\n} catch (err) {\n  if (err.message.startsWith('Pi auth: no credentials')) {\n    console.error(err.message); // message names the exact env var and /login fallback\n    process.exitCode = 1;\n  }\n  throw err;\n}","preventionTips":["Export provider API keys in deployment env or .archon/config.yaml env: section","For Claude subscriptions set ANTHROPIC_OAUTH_TOKEN, not just ANTHROPIC_API_KEY","Run `pi /login` during machine provisioning","Add a pre-flight credential check per provider before launching workflows"],"tags":["auth","credentials","environment","pi"],"backgroundTag":"missing-api-credentials","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}