{"record":{"id":"505c88948bd1038b","repo":"google-gemini/gemini-cli","slug":"the-auth-type-enforcedtype-is-enforced-but-n","errorCode":null,"errorMessage":"The auth type '${enforcedType}' is enforced, but no authentication is configured.","messagePattern":"The auth type '(.+?)' is enforced, but no authentication is configured\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/validateNonInterActiveAuth.ts","lineNumber":34,"sourceCode":"import { validateAuthMethod } from './config/auth.js';\nimport { handleError } from './utils/errors.js';\nimport { runExitCleanup } from './utils/cleanup.js';\n\nexport async function validateNonInteractiveAuth(\n  configuredAuthType: AuthType | undefined,\n  useExternalAuth: boolean | undefined,\n  nonInteractiveConfig: Config,\n  settings: LoadedSettings,\n) {\n  try {\n    const effectiveAuthType = configuredAuthType || getAuthTypeFromEnv();\n\n    const enforcedType = settings.merged.security.auth.enforcedType;\n    if (enforcedType && effectiveAuthType !== enforcedType) {\n      const message = effectiveAuthType\n        ? `The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.`\n        : `The auth type '${enforcedType}' is enforced, but no authentication is configured.`;\n      throw new Error(message);\n    }\n\n    if (!effectiveAuthType) {\n      const message = `Please set an Auth method in your ${USER_SETTINGS_PATH} or specify one of the following environment variables before running: GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA`;\n      throw new Error(message);\n    }\n\n    const authType: AuthType = effectiveAuthType;\n\n    if (!useExternalAuth) {\n      const err = await validateAuthMethod(String(authType));\n      if (err != null) {\n        throw new Error(err);\n      }\n    }\n\n    return authType;\n  } catch (error) {","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/validateNonInterActiveAuth.ts#L16-L52","documentation":"Thrown from the same enforced-auth branch as error 165, but for the more specific case where an `enforcedType` is configured yet the caller has *no* effective auth type at all — neither config nor environment provides any credential. The branch fires because `enforcedType` is set and `effectiveAuthType` is falsy, so the message states that the enforced type exists but nothing is configured to satisfy it.","triggerScenarios":"Calling `validateNonInteractiveAuth` with `security.auth.enforcedType` populated while `configuredAuthType` is empty and `getAuthTypeFromEnv()` returns nothing (no `GEMINI_API_KEY`, no Vertex flag, no GCA flag, no prior OAuth).","commonSituations":"Fresh checkout on a new machine where policy enforces a type but the user never ran interactive login; env vars accidentally cleared by a shell reset; an enforced type was added by an admin but onboarding docs weren't updated; running in a container with a fresh home dir.","solutions":["Authenticate with the method matching `enforcedType` — run the appropriate interactive login flow first.","Set the matching environment variable for the enforced type (e.g. `GEMINI_API_KEY` if enforced type is `gemini-api-key`).","If enforcement is unintended, remove or correct `security.auth.enforcedType` in the responsible settings file.","Verify the merged settings to confirm which layer (user vs project) is contributing the enforcement."],"exampleFix":"# before — enforcedType set, no creds anywhere\n$ gemini -p 'hi'  # throws\n\n# after — provide matching creds\n$ GEMINI_API_KEY=xxxx gemini -p 'hi'  # if enforcedType is gemini-api-key","handlingStrategy":"validation","validationCode":"function assertAuthPresent(\n  enforcedType: string | undefined,\n  effectiveType: string | undefined,\n) {\n  if (enforcedType && !effectiveType) {\n    throw new Error(`Auth '${enforcedType}' is enforced but not configured.`);\n  }\n}\n\nconst enforced = settings.merged.security.auth.enforcedType;\nconst effective = configuredAuthType ?? getAuthTypeFromEnv();\nassertAuthPresent(enforced, effective);","typeGuard":"function isAuthConfiguredForEnforced(\n  enforced: string | undefined,\n  effective: string | undefined,\n): boolean {\n  return !enforced || Boolean(effective);\n}","tryCatchPattern":"try {\n  await validateNonInteractiveAuth(configuredAuthType, useExternalAuth, cfg, settings);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('no authentication is configured')) {\n    // route user to the login flow for the enforced type\n  }\n  throw e;\n}","preventionTips":["Provision credentials for the enforced type before first run; document this in onboarding.","Use a preflight check in deploy scripts to fail before the CLI does, with a clearer message.","Keep enforcedType and the provisioning playbook versioned together."],"tags":["auth","config","security-policy","headless"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}