{"record":{"id":"187df14c2b409a60","repo":"zeroclaw-labs/zeroclaw","slug":"auth-refresh-is-not-supported-for-this-provider","errorCode":null,"errorMessage":"`auth refresh` is not supported for this provider. Only OpenAI Codex and Gemini have an in-process token-refresh flow.","messagePattern":"`auth refresh` is not supported for this provider\\. Only OpenAI Codex and Gemini have an in-process token-refresh flow\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"warning","filePath":"crates/zeroclaw-providers/src/auth/mod.rs","lineNumber":1078,"sourceCode":"        _ctx: &AuthFlowContext<'_>,\n        _profile: &str,\n        _input: Option<&str>,\n    ) -> Result<()> {\n        anyhow::bail!(\n            \"`auth paste-redirect` is not supported for this provider. Only OpenAI Codex and \\\n             Gemini expose a browser-based OAuth flow.\",\n        )\n    }\n\n    /// Refresh the access token for `profile_override` (or active\n    /// profile) and report status. Default impl bails for providers\n    /// without a refresh flow.\n    async fn refresh_status(\n        &self,\n        _ctx: &AuthFlowContext<'_>,\n        _profile_override: Option<&str>,\n    ) -> Result<RefreshStatus> {\n        anyhow::bail!(\n            \"`auth refresh` is not supported for this provider. Only OpenAI Codex and Gemini \\\n             have an in-process token-refresh flow.\",\n        )\n    }\n}\n\nimpl AuthProvider {\n    /// Resolve the per-variant `AuthProviderFlow` impl for trait dispatch.\n    /// The `match self` here is on enum variants — the only place an\n    /// auth-flow dispatch exists, every other call site routes through\n    /// the returned trait object.\n    pub fn flow(&self) -> Box<dyn AuthProviderFlow> {\n        match self {\n            Self::OpenaiCodex => Box::new(OpenaiCodexFlow),\n            Self::Gemini => Box::new(GeminiFlow),\n            Self::Anthropic => Box::new(AnthropicFlow),\n            Self::Xai => Box::new(XaiFlow),\n        }","sourceCodeStart":1060,"sourceCodeEnd":1096,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-providers/src/auth/mod.rs#L1060-L1096","documentation":"Default AuthProviderImpl::refresh_status, inherited by providers with no in-process token refresh. Only OpenAI Codex and Gemini override it with a real refresh flow; bearer-token providers store static keys that never refresh, so `auth refresh` bails with this message instead of pretending to succeed. handle_auth_command routes the `auth refresh` subcommand here.","triggerScenarios":"Running `zeroclaw auth refresh --model-provider <bearer-provider>` (or with that provider active) for a provider without a refresh implementation.","commonSituations":"Automated token-rotation scripts applied uniformly to every configured provider, or refreshing after switching the active provider to an API-key one.","solutions":["Skip `auth refresh` for bearer providers — the stored key does not expire via OAuth; rotate it with `auth paste-token` when it changes","Target a refreshable provider explicitly: `zeroclaw auth refresh --model-provider openai-codex` or `--model-provider gemini`","Filter provider lists in automation to only refresh-supported providers"],"exampleFix":"# before: blanket refresh over all providers\nfor p in anthropic openai-codex gemini; do zeroclaw auth refresh --model-provider $p; done\n\n# after: refresh only providers with an in-process flow\nfor p in openai-codex gemini; do zeroclaw auth refresh --model-provider $p; done","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"match provider.refresh_status(ctx, None).await {\n    Ok(status) => Ok(status),\n    Err(e) if e.to_string().contains(\"auth refresh` is not supported\") => {\n        Ok(RefreshStatus::NotRefreshable) // bearer tokens: nothing to refresh\n    }\n    Err(e) => Err(e),\n}","preventionTips":["Maintain an explicit list of refresh-supported providers (openai-codex, gemini) in automation","Rotate bearer keys via paste-token on your own schedule instead of auth refresh"],"tags":["auth","cli","unsupported-operation","token-refresh"],"backgroundTag":"unsupported-auth-method","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}