{"record":{"id":"27df7cb28a380e64","repo":"google-gemini/gemini-cli","slug":"the-enforced-authentication-type-is-enforcedtyp","errorCode":null,"errorMessage":"The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.","messagePattern":"The enforced authentication type is '(.+?)', but the current type is '(.+?)'\\. Please re-authenticate with the correct type\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/validateNonInterActiveAuth.ts","lineNumber":34,"sourceCode":"import { validateAuthMethod } from './config/auth.js';\nimport { handleError } from './utils/errors.js';\nimport { runExitCleanup } from './utils/cleanup.js';\n\nexport async function validateNonInteractiveAuth(\n  configuredAuthType: AuthType | undefined,\n  useExternalAuth: boolean | undefined,\n  nonInteractiveConfig: Config,\n  settings: LoadedSettings,\n) {\n  try {\n    const effectiveAuthType = configuredAuthType || getAuthTypeFromEnv();\n\n    const enforcedType = settings.merged.security.auth.enforcedType;\n    if (enforcedType && effectiveAuthType !== enforcedType) {\n      const message = effectiveAuthType\n        ? `The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.`\n        : `The auth type '${enforcedType}' is enforced, but no authentication is configured.`;\n      throw new Error(message);\n    }\n\n    if (!effectiveAuthType) {\n      const message = `Please set an Auth method in your ${USER_SETTINGS_PATH} or specify one of the following environment variables before running: GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA`;\n      throw new Error(message);\n    }\n\n    const authType: AuthType = effectiveAuthType;\n\n    if (!useExternalAuth) {\n      const err = await validateAuthMethod(String(authType));\n      if (err != null) {\n        throw new Error(err);\n      }\n    }\n\n    return authType;\n  } catch (error) {","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/validateNonInterActiveAuth.ts#L16-L52","documentation":"Thrown during non-interactive auth validation when `settings.merged.security.auth.enforcedType` is set (an org/policy lockdown to one auth method) but the effective auth type resolved from config or env vars differs. The effective type is the user's currently configured credential; the enforced type is the mandatory one. Mismatch is fatal in headless mode because silently picking a different auth path would bypass policy.","triggerScenarios":"Calling `validateNonInteractiveAuth` (or starting the CLI headlessly) with `security.auth.enforcedType` set to e.g. `oauth-personal` while the environment carries `GEMINI_API_KEY` (which resolves to `gemini-api-key`), or with `GOOGLE_GENAI_USE_VERTEXAI=true` while enforcement demands `cloud-login`. `effectiveAuthType` is non-empty but unequal to `enforcedType`.","commonSituations":"A team policy file pins `enforcedType: oauth-personal` but a developer has `GEMINI_API_KEY` exported in their shell; migrating from API-key auth to Vertex AI without updating the enforcement setting; an enterprise settings merge layer enforces a type that conflicts with the local `.env`.","solutions":["Re-authenticate using the method named in `enforcedType` (e.g. run the interactive login for `oauth-personal`).","Remove or correct the environment variable that is selecting the wrong auth type (`GEMINI_API_KEY`, `GOOGLE_GENAI_USE_VERTEXAI`, etc.).","If the enforcement itself is wrong, update `security.auth.enforcedType` in the merged settings source (user or project settings file) to the intended type.","Confirm which settings file is contributing `enforcedType` — the value comes from `settings.merged`, so a project-level file can override your user-level config."],"exampleFix":"# before — settings.json\n{ \"security\": { \"auth\": { \"enforcedType\": \"oauth-personal\" } } }\n# but env has GEMINI_API_KEY set\n\n# after — clear the conflicting env var and log in\n$ unset GEMINI_API_KEY\n$ gemini  # interactive oauth-personal login","handlingStrategy":"validation","validationCode":"function assertAuthMatchesEnforced(\n  enforcedType: string | undefined,\n  effectiveType: string | undefined,\n) {\n  if (enforcedType && effectiveType && enforcedType !== effectiveType) {\n    throw new Error(\n      `Auth mismatch: enforced=${enforcedType}, effective=${effectiveType}. Re-authenticate as ${enforcedType}.`,\n    );\n  }\n}\n\nconst enforced = settings.merged.security.auth.enforcedType;\nconst effective = configuredAuthType ?? getAuthTypeFromEnv();\nassertAuthMatchesEnforced(enforced, effective);","typeGuard":"function isAuthCompatible(\n  enforced: string | undefined,\n  effective: string | undefined,\n): boolean {\n  return !enforced || !effective || enforced === effective;\n}","tryCatchPattern":"try {\n  await validateNonInteractiveAuth(configuredAuthType, useExternalAuth, cfg, settings);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('enforced authentication type')) {\n    // prompt re-login with enforcedType, or surface to operator\n  }\n  throw e;\n}","preventionTips":["Centralize auth selection in one config layer so env and settings never disagree.","In policy-driven orgs, document the enforcedType alongside the provisioning steps for that type.","Add a startup preflight that fails fast with a friendly message before the heavy CLI boots."],"tags":["auth","config","security-policy","headless"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}