{"record":{"id":"177e26c5386a018c","repo":"Significant-Gravitas/AutoGPT","slug":"provider-runtime-credentials-cannot-be-created-dir","errorCode":null,"errorMessage":"Provider-runtime credentials cannot be created directly","messagePattern":"Provider-runtime credentials cannot be created directly","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/integrations/router.py","lineNumber":584,"sourceCode":"        ProviderName, Path(title=\"The provider to create credentials for\")\n    ],\n    credentials: Credentials,\n) -> CredentialsMetaResponse:\n    if is_sdk_default(credentials.id):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Cannot create credentials with a reserved ID\",\n        )\n    if provider == ProviderName.CODEX:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Codex credentials must be created through ChatGPT sign-in\",\n        )\n    if (\n        isinstance(credentials, OAuth2Credentials)\n        and credentials.refresh_strategy == \"provider_runtime\"\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Provider-runtime credentials cannot be created directly\",\n        )\n    credentials.provider = provider\n    try:\n        await creds_manager.create(user_id, credentials)\n    except Exception:\n        logger.exception(\"Failed to store credentials\")\n        raise HTTPException(\n            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n            detail=\"Failed to store credentials\",\n        )\n    return to_meta_response(credentials)\n\n\nclass CredentialsDeletionResponse(BaseModel):\n    deleted: Literal[True] = True\n    revoked: bool | None = Field(","sourceCodeStart":566,"sourceCodeEnd":602,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/integrations/router.py#L566-L602","documentation":"POST /integrations/{provider}/credentials returns 400 'Provider-runtime credentials cannot be created directly' when the payload is an OAuth2 credential with refresh_strategy == 'provider_runtime'. Such credentials only materialize tokens at call time against the provider's runtime, so they cannot be constructed by clients; they are minted internally by the platform.","triggerScenarios":"POST credentials with {\"type\": \"oauth2\", \"refresh_strategy\": \"provider_runtime\", ...}.","commonSituations":"Client copies an internal credential shape from logs/docs; migration script re-imports exported credentials verbatim including the internal refresh strategy.","solutions":["Drop refresh_strategy from the payload (defaults apply) or set the standard strategy for client-created OAuth2 creds","If you genuinely need provider_runtime behavior, use the platform flow that creates it internally — not this endpoint"],"exampleFix":"// before\n{\"type\": \"oauth2\", \"refresh_strategy\": \"provider_runtime\", ...}\n\n// after\n{\"type\": \"oauth2\", ...}  // standard refresh strategy","handlingStrategy":"validation","validationCode":"payload.pop('refresh_strategy', None)  # never send provider_runtime to the create endpoint","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat provider_runtime as an internal implementation detail"],"tags":["credentials","oauth2","refresh-strategy","http-400"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}