{"record":{"id":"3a58321d073d0464","repo":"chroma-core/chroma","slug":"invalid-auth-provider","errorCode":null,"errorMessage":"Invalid auth provider","messagePattern":"Invalid auth provider","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"clients/js/packages/chromadb-core/src/auth.ts","lineNumber":103,"sourceCode":"  auth: AuthOptions,\n): ClientAuthProvider => {\n  if (auth.provider === undefined) {\n    throw new Error(\"Auth provider not specified\");\n  }\n  if (auth.credentials === undefined) {\n    throw new Error(\"Auth credentials not specified\");\n  }\n  switch (auth.provider) {\n    case \"basic\":\n      return new BasicAuthClientProvider(auth.credentials);\n    case \"token\":\n      return new TokenAuthClientProvider(\n        auth.credentials,\n        auth.tokenHeaderType,\n      );\n      break;\n    default:\n      throw new Error(\"Invalid auth provider\");\n  }\n};\n","sourceCodeStart":85,"sourceCodeEnd":106,"githubUrl":"https://github.com/chroma-core/chroma/blob/aecdd12c8a891610db8653630b066b32ceb678b5/clients/js/packages/chromadb-core/src/auth.ts#L85-L106","documentation":"The switch in authOptionsToAuthProvider only recognizes 'basic' and 'token'; any other provider string falls through to default and throws 'Invalid auth provider'. AuthOptions.provider is typed ClientAuthProvider | string | undefined, so TypeScript will NOT catch a misspelled or unsupported value - the failure happens at runtime, during client construction.","triggerScenarios":"auth: { provider: 'apikey', ... }; provider: 'tokens' or 'Token' (case/typo); provider: 'oidc' or another scheme the JS client does not implement; provider passed as a provider instance instead of the literal string.","commonSituations":"Copying auth config from Chroma server docs that list server-side providers (e.g. 'chromadb.auth.token_authn.TokenAuthenticationServerProvider') into the client options; version drift where a provider exists in Python but not in the JS client.","solutions":["Use one of the two supported literals: provider: 'basic' or provider: 'token'.","Restrict your own config type to a union ('basic' | 'token') so invalid values fail at compile time.","If you need a custom scheme, implement ClientAuthProvider (authenticate(): AuthHeaders) and wire the headers yourself instead of passing an unknown string."],"exampleFix":"// before\nnew ChromaClient({ auth: { provider: 'bearer', credentials: tok } });\n\n// after\nnew ChromaClient({ auth: { provider: 'token', credentials: tok } });","handlingStrategy":"type-guard","validationCode":"const SUPPORTED = ['basic', 'token'] as const;\nif (!SUPPORTED.includes(auth.provider as (typeof SUPPORTED)[number])) {\n  throw new Error(`Unsupported auth provider '${auth.provider}'; use basic or token`);\n}","typeGuard":"type SupportedProvider = 'basic' | 'token';\nfunction isSupportedProvider(v: unknown): v is SupportedProvider {\n  return v === 'basic' || v === 'token';\n}","tryCatchPattern":"try {\n  new ChromaClient({ auth });\n} catch (e) {\n  if (e instanceof Error && e.message === 'Invalid auth provider') {\n    // map your scheme to 'basic' or 'token', or implement ClientAuthProvider manually\n  }\n  throw e;\n}","preventionTips":["Restrict your own config type to provider: 'basic' | 'token' so typos fail at compile time.","Do not copy server-side provider class names into client auth options.","For custom schemes, implement ClientAuthProvider and set headers via fetchOptions instead of auth.provider."],"tags":["auth","configuration","validation","client-construction","unsupported-provider"],"backgroundTag":"unsupported-auth-provider","analyzedSha":"aecdd12c8a891610db8653630b066b32ceb678b5","analyzedAt":"2026-08-16T21:53:27.228Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}