{"record":{"id":"0e067882b9bb24bb","repo":"Significant-Gravitas/AutoGPT","slug":"picker-tokens-are-only-available-for-oauth2-creden","errorCode":null,"errorMessage":"Picker tokens are only available for OAuth2 credentials","messagePattern":"Picker tokens are only available for OAuth2 credentials","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/integrations/router.py","lineNumber":526,"sourceCode":"    token + its expiry — nothing else about the credential. SDK-default\n    credentials are excluded for the same reason as `get_credential`.\n    \"\"\"\n    if is_sdk_default(cred_id):\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n\n    credential = await creds_manager.get(user_id, cred_id)\n    if not credential:\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n    if not provider_matches(credential.provider, provider):\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n    if not isinstance(credential, OAuth2Credentials):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Picker tokens are only available for OAuth2 credentials\",\n        )\n    if not credential.access_token:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Credential has no access token; reconnect the account\",\n        )\n\n    # Gate on provider+scope: only credentials that actually grant access to\n    # a provider-hosted picker flow may mint a token through this endpoint.\n    # Prevents using this path to extract bearer tokens for unrelated OAuth\n    # integrations (e.g. GitHub) that happen to be stored under the same user.\n    allowed_scopes = _PICKER_TOKEN_ALLOWED_SCOPES.get(provider)\n    if not allowed_scopes:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=(f\"Picker tokens are not available for provider '{provider.value}'\"),","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/integrations/router.py#L508-L544","documentation":"The picker-token endpoint returns 400 'Picker tokens are only available for OAuth2 credentials' when the fetched credential is not an OAuth2Credentials instance — e.g. an APIKeyCredentials (API key/secret) was passed. Picker flows need an OAuth bearer access token, which API-key credentials do not have.","triggerScenarios":"POST /integrations/{provider}/credentials/{api-key-cred-id}/picker-token where the stored credential is of type 'api_key' (or any non-oauth2 type).","commonSituations":"User connected a provider by pasting an API key where the UI expects an OAuth connection; cred_id resolved to the wrong credential of the same provider.","solutions":["Check the credential's type via the list endpoint ('type' field); picker-token requires 'oauth2'","Connect the provider through OAuth (login flow) instead of pasting an API key","In UI, only enable the picker entry point when the selected credential is OAuth2"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"meta = next(c for c in all_credentials if c['id'] == cred_id)\nif meta['type'] != 'oauth2':\n    raise TypeError('picker token requires an OAuth2 credential; connect via sign-in, not API key')","typeGuard":"function isOAuth2Credential(meta: { type: string }): boolean {\n  return meta.type === 'oauth2';\n}","tryCatchPattern":null,"preventionTips":["Gate picker UI on credential.type === 'oauth2'"],"tags":["credentials","picker","oauth2","http-400"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}