{"record":{"id":"3e1de1a8d10b0927","repo":"github/spec-kit","slug":"providers-i-provider-provider-r-does-not-sup","errorCode":null,"errorMessage":"providers[{i}]: provider {provider!r} does not support auth scheme {auth!r}; supported: {list(_prov.supported_auth_schemes)}","messagePattern":"providers\\[(.+?)\\]: provider (.+?) does not support auth scheme (.+?); supported: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/specify_cli/authentication/config.py","lineNumber":172,"sourceCode":"        token_env = entry_raw.get(\"token_env\")\n\n        # Validate token/token_env types\n        if token is not None and (not isinstance(token, str) or not token.strip()):\n            raise ValueError(f\"providers[{i}]: 'token' must be a non-empty string\")\n        if token_env is not None and (not isinstance(token_env, str) or not token_env.strip()):\n            raise ValueError(f\"providers[{i}]: 'token_env' must be a non-empty string\")\n\n        # Validate provider+scheme compatibility\n        from . import get_provider as _get_provider\n        _prov = _get_provider(provider)\n        if _prov is None:\n            from . import AUTH_REGISTRY\n            raise ValueError(\n                f\"providers[{i}]: unknown provider {provider!r}; \"\n                f\"registered: {sorted(AUTH_REGISTRY.keys())}\"\n            )\n        if auth not in _prov.supported_auth_schemes:\n            raise ValueError(\n                f\"providers[{i}]: provider {provider!r} does not support \"\n                f\"auth scheme {auth!r}; supported: {list(_prov.supported_auth_schemes)}\"\n            )\n\n        # Validate token source based on auth scheme\n        if auth in (\"bearer\", \"basic-pat\"):\n            if not token and not token_env:\n                raise ValueError(\n                    f\"providers[{i}]: auth={auth!r} requires 'token' or 'token_env'\"\n                )\n        elif auth == \"azure-ad\":\n            tenant_id = entry_raw.get(\"tenant_id\")\n            client_id = entry_raw.get(\"client_id\")\n            client_secret_env = entry_raw.get(\"client_secret_env\")\n            if not all([tenant_id, client_id, client_secret_env]):\n                raise ValueError(\n                    f\"providers[{i}]: auth='azure-ad' requires \"\n                    \"'tenant_id', 'client_id', and 'client_secret_env'\"","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/github/spec-kit/blob/bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c/src/specify_cli/authentication/config.py#L154-L190","documentation":"Raised when the provider resolved from `AUTH_REGISTRY` does not list the configured `auth` scheme among its `supported_auth_schemes`. The message enumerates the schemes that particular provider actually supports so you can correct the combination.","triggerScenarios":"Pairing a provider with a scheme it does not implement — e.g. `provider: github` with `auth: azure-ad`, or an Azure provider with `auth: basic-pat` when it only supports `azure-ad`/`bearer`.","commonSituations":"Copy-pasting an example entry for a different provider and only changing the `provider` field; assuming all providers support `bearer`; upgrading spec-kit changed a provider's supported scheme set.","solutions":["Use one of the schemes listed in the error's `supported: [...]` for that provider","If you need a different scheme, switch to a provider that supports it","Re-check the docs/examples for your specific provider version"],"exampleFix":"# before\n- hosts: [\"github.com\"]\n  provider: github\n  auth: azure-ad\n\n# after\n- hosts: [\"github.com\"]\n  provider: github\n  auth: bearer","handlingStrategy":"type-guard","validationCode":"from specify_cli.authentication import get_provider\n\nprov = get_provider(entry[\"provider\"])\nif entry[\"auth\"] not in prov.supported_auth_schemes:\n    raise SystemExit(\n        f\"{entry['provider']!r} supports {list(prov.supported_auth_schemes)}, \"\n        f\"not {entry['auth']!r}\"\n    )","typeGuard":"def scheme_supported(provider: str, auth: str) -> bool:\n    prov = get_provider(provider)\n    return prov is not None and auth in prov.supported_auth_schemes","tryCatchPattern":"try:\n    load_auth_config(raw)\nexcept ValueError as exc:\n    if \"does not support auth scheme\" in str(exc):\n        # read 'supported: [...]' from the message and switch scheme/provider\n        raise\n    raise","preventionTips":["Check provider.supported_auth_schemes programmatically when generating configs","When changing provider in an entry, re-derive the auth scheme too — they travel together"],"tags":["authentication","config","validation","provider-mismatch"],"backgroundTag":null,"analyzedSha":"bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c","analyzedAt":"2026-08-14T19:43:37.150Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}