{"record":{"id":"9733479654a725d9","repo":"Significant-Gravitas/AutoGPT","slug":"username-mismatch-authenticated-as-a-different-us","errorCode":null,"errorMessage":"Username mismatch: authenticated as a different user","messagePattern":"Username mismatch: authenticated as a different user","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/integrations/router.py","lineNumber":1123,"sourceCode":"            detail=\"Credential to upgrade not found\",\n        )\n    if existing.is_managed:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Managed credentials cannot be upgraded\",\n        )\n    if not provider_matches(existing.provider, new_credentials.provider):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Credential provider does not match the requested provider\",\n        )\n\n    if (\n        existing.username\n        and new_credentials.username\n        and existing.username != new_credentials.username\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Username mismatch: authenticated as a different user\",\n        )\n\n    # Operate on a copy so the caller's ``new_credentials`` object is not\n    # mutated out from under them.  Every caller today immediately discards\n    # or replaces its reference, but the implicit-merge path in\n    # ``_merge_or_create_credential`` reads ``credentials.scopes`` before\n    # calling into us — a future reader after the call would otherwise\n    # silently see the overwritten values.\n    merged = new_credentials.model_copy(deep=True)\n    merged.id = existing.id\n    merged.title = existing.title\n    merged.scopes = list(set(existing.scopes) | set(new_credentials.scopes))\n    merged.metadata = {\n        **(existing.metadata or {}),\n        **(new_credentials.metadata or {}),\n    }","sourceCodeStart":1105,"sourceCodeEnd":1141,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/integrations/router.py#L1105-L1141","documentation":"In _upgrade_existing_credential, if both the existing credential and the newly obtained one carry a username and they differ, HTTP 400 'Username mismatch: authenticated as a different user' is raised. Scope upgrade is only valid when the same external account re-consents; merging tokens from a different external account into an existing credential would silently switch whose data the credential accesses.","triggerScenarios":"User initiates 'upgrade scopes' on a credential for account alice@provider, but during the OAuth consent step signs in as bob@provider (different account selected at the provider, or browser logged into another account). The callback detects existing.username != new_credentials.username and aborts the merge.","commonSituations":"Shared workstations where the browser's provider session belongs to a different account; user switching company accounts mid-flow; provider defaulting to a personal account when the credential was created with a work account.","solutions":["Sign out of the other account at the provider (or use an incognito window) and redo the upgrade flow, ensuring you consent as the same account that owns the existing credential.","If you intentionally want the other account, create a new credential instead of upgrading the existing one.","Check the existing credential's username field first so you know which account to authenticate as."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Show the user which account must re-consent before redirecting\nexisting = await get_credential(existing_cred_id)\nif existing.get(\"username\"):\n    display(f\"Re-authorize as {existing['username']} to upgrade scopes\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Display the credential's username before starting the upgrade so users pick the right account.","Suggest an incognito window when the browser may hold a different provider session.","Offer 'create new credential' as an alternative when the user intends a different account."],"tags":["oauth","credentials","http-400","account-mismatch","security"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}