{"record":{"id":"8ffb375cda98d489","repo":"n8n-io/n8n","slug":"invalid-credentials-for-provider-provider","errorCode":null,"errorMessage":"Invalid credentials for provider \"${provider}\":\n${issues}","messagePattern":"Invalid credentials for provider \"(.+?)\":\n(.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@n8n/agents/src/runtime/model/model-factory.ts","lineNumber":266,"sourceCode":"\t\tcredFields = rest;\n\t}\n\t// Host configs (e.g. Instance AI's `{ id, url }` for OpenAI-compatible\n\t// endpoints) spell the base URL as `url`; the provider schemas only know\n\t// `baseURL`, and Zod strips unknown keys, so normalize before validation.\n\t// An EMPTY url means \"no custom endpoint\" (Instance AI emits `url: ''` for\n\t// the api-key-only config) and must keep the provider default.\n\tif (typeof credFields.url === 'string' && credFields.baseURL === undefined) {\n\t\tconst { url, ...restCreds } = credFields;\n\t\tcredFields = url ? { ...restCreds, baseURL: url } : restCreds;\n\t}\n\n\tconst schema = PROVIDER_CREDENTIAL_SCHEMAS[provider];\n\tconst parsed = schema.safeParse(credFields);\n\tif (!parsed.success) {\n\t\tconst issues = parsed.error.issues\n\t\t\t.map((i) => `  - ${i.path.join('.')}: ${i.message}`)\n\t\t\t.join('\\n');\n\t\tthrow new Error(`Invalid credentials for provider \"${provider}\":\\n${issues}`);\n\t}\n\n\t// Caller-injected transport wins; fall back to the ambient env-proxy resolver.\n\tconst resolvedFetch = fetch ?? getProxyFetch();\n\t// Type cast: the registry guarantees the schema and builder are aligned per provider.\n\treturn (entry.build as EntryBuilder<typeof provider>)(\n\t\tparsed.data as never,\n\t\tmodelName,\n\t\tresolvedFetch,\n\t);\n}\n\n/**\n * Registry of embedding provider packages and their factory function names.\n * Each AI SDK provider follows the same pattern:\n *   createProvider({ apiKey }).embeddingModel(modelName)\n *\n * To add a new provider, install its @ai-sdk/* package and add an entry here.","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/agents/src/runtime/model/model-factory.ts#L248-L284","documentation":"After resolving the provider, `createModel` passes the credential fields (everything except `id`) through a Zod schema specific to that provider (`PROVIDER_CREDENTIAL_SCHEMAS[provider]`). If validation fails, it formats the Zod issues (path + message per issue) and throws. This catches missing required fields, wrong types, and invalid formats in the credential object.","triggerScenarios":"Passing `createModel({ id: 'anthropic/claude-sonnet-4-5' })` with no API key when the Anthropic schema requires one. Passing `createModel({ id: 'aws-bedrock/claude', apiKey: '...' })` when Bedrock requires `region`, `accessKeyId`, `secretAccessKey`. Passing a malformed URL for `baseURL`.","commonSituations":"The credential resolution layer (e.g. n8n credential decryption) returned an incomplete or empty object. The wrong credential type was bound to the provider (e.g. OpenAI credential for a Bedrock model). A required field like `apiVersion` for Azure was omitted. Environment variables for the credential were not set.","solutions":["Read the formatted issues in the error message — each line names the field path and what Zod requires.","Provide the missing or corrected credential fields in the config object passed to `createModel`.","Verify the credential type matches the provider (Anthropic credential for `anthropic/`, Bedrock credential for `aws-bedrock/`, etc.).","Check the credential resolution pipeline — ensure decryption/lookup actually populates every field the provider schema requires."],"exampleFix":"// before:\ncreateModel({ id: 'aws-bedrock/claude-3-opus', apiKey: 'xxx' });\n// Error: Bedrock schema requires region, accessKeyId, secretAccessKey\n\n// after:\ncreateModel({\n  id: 'aws-bedrock/claude-3-opus',\n  region: 'us-east-1',\n  accessKeyId: process.env.AWS_ACCESS_KEY_ID,\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,\n});","handlingStrategy":"validation","validationCode":"import { PROVIDER_CREDENTIAL_SCHEMAS, type ProviderId } from './provider-credentials';\n\nfunction validateCredentials(provider: ProviderId, creds: Record<string, unknown>): void {\n  const schema = PROVIDER_CREDENTIAL_SCHEMAS[provider];\n  const result = schema.safeParse(creds);\n  if (!result.success) {\n    throw new Error(`Credential validation failed for ${provider}: ${result.error.message}`);\n  }\n}\n\n// Before createModel:\nvalidateCredentials(provider, credFields);","typeGuard":null,"tryCatchPattern":"try {\n  const model = createModel(config);\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('Invalid credentials')) {\n    // Show credential configuration error to user\n    logger.error('Model credential validation failed', { issues: e.message });\n  }\n  throw e;\n}","preventionTips":["Validate credentials with the provider's Zod schema before calling createModel.","Ensure the credential resolution pipeline (decryption, lookup) populates every required field.","Match credential type to provider (Anthropic cred for anthropic/, Bedrock cred for aws-bedrock/).","Run credential validation at config-save time in the UI."],"tags":["model-config","credentials","zod-validation","provider","security"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}