{"record":{"id":"a577f34d26af3298","repo":"github/spec-kit","slug":"azuredevopsauth-does-not-support-auth-scheme-auth","errorCode":null,"errorMessage":"AzureDevOpsAuth does not support auth scheme {auth_scheme!r}","messagePattern":"AzureDevOpsAuth does not support auth scheme (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/specify_cli/authentication/azure_devops.py","lineNumber":57,"sourceCode":"    Supports four auth schemes:\n\n    * ``basic-pat`` — PAT with empty username, Base64-encoded as ``:<PAT>``\n    * ``bearer`` — pre-acquired OAuth / Azure AD token\n    * ``azure-cli`` — acquires a token via ``az account get-access-token``\n    * ``azure-ad`` — acquires a token via OAuth2 client credentials flow\n    \"\"\"\n\n    key = \"azure-devops\"\n    supported_auth_schemes = (\"basic-pat\", \"bearer\", \"azure-cli\", \"azure-ad\")\n\n    def auth_headers(self, token: str, auth_scheme: str) -> dict[str, str]:\n        \"\"\"Build the ``Authorization`` header for the given scheme.\"\"\"\n        if auth_scheme == \"basic-pat\":\n            encoded = base64.b64encode(f\":{token}\".encode(\"ascii\")).decode(\"ascii\")\n            return {\"Authorization\": f\"Basic {encoded}\"}\n        if auth_scheme in (\"bearer\", \"azure-cli\", \"azure-ad\"):\n            return {\"Authorization\": f\"Bearer {token}\"}\n        raise ValueError(\n            f\"AzureDevOpsAuth does not support auth scheme {auth_scheme!r}\"\n        )\n\n    def resolve_token(self, entry: AuthConfigEntry) -> str | None:\n        \"\"\"Resolve token, with special handling for azure-cli and azure-ad.\"\"\"\n        if entry.auth == \"azure-cli\":\n            return self._acquire_via_az_cli()\n        if entry.auth == \"azure-ad\":\n            return self._acquire_via_client_credentials(entry)\n        return super().resolve_token(entry)\n\n    # -- Token acquisition ------------------------------------------------\n\n    @staticmethod\n    def _acquire_via_az_cli() -> str | None:\n        \"\"\"Run ``az account get-access-token`` and return the access token.\"\"\"\n        try:\n            # Windows: ``subprocess.run`` calls ``CreateProcess``, which does","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/github/spec-kit/blob/bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c/src/specify_cli/authentication/azure_devops.py#L39-L75","documentation":"AzureDevOpsAuth.auth_headers() maps an auth scheme to an Authorization header: 'basic-pat' becomes Basic base64(':' + token), and 'bearer'/'azure-cli'/'azure-ad' become Bearer <token>. Any other scheme string raises ValueError, because Azure DevOps has no other supported header construction in this provider.","triggerScenarios":"auth.json entry with \"auth\": \"pat\", \"npat\", \"Basic-PAT\" (case-sensitive), or \"token\" for an azure-devops provider; a config value copied from a different tool's scheme names; passing auth_scheme programmatically with a typo.","commonSituations":"Migrating from gh/git credential configs whose scheme vocabulary differs; uppercase variants assumed to be normalized; new Azure schemes (e.g. workload identity) not yet supported by the installed version.","solutions":["Set \"auth\" in the azure-devops provider entry to one of: \"basic-pat\", \"bearer\", \"azure-cli\", \"azure-ad\" (exact lowercase).","For a classic Azure DevOps PAT used against the REST API, \"basic-pat\" is the standard choice.","For Entra ID scenarios use \"azure-cli\" (az cli acquisition) or \"azure-ad\" (client credentials) instead of inventing a scheme.","Upgrade specify-cli if you need a scheme added in a newer release."],"exampleFix":"# before (auth.json)\n{\"providers\": [{\"hosts\": [\"dev.azure.com\"], \"provider\": \"azure-devops\", \"auth\": \"pat\", \"token\": \"...\"}]}\n# after\n{\"providers\": [{\"hosts\": [\"dev.azure.com\"], \"provider\": \"azure-devops\", \"auth\": \"basic-pat\", \"token\": \"...\"}]}","handlingStrategy":"validation","validationCode":"SUPPORTED = {\"basic-pat\", \"bearer\", \"azure-cli\", \"azure-ad\"}\n\nif entry.auth not in SUPPORTED:\n    raise SystemExit(\n        f\"unsupported azure-devops auth {entry.auth!r}; use one of {sorted(SUPPORTED)}\"\n    )","typeGuard":"from typing import Any\n\nSUPPORTED = {\"basic-pat\", \"bearer\", \"azure-cli\", \"azure-ad\"}\n\ndef is_supported_ado_scheme(scheme: Any) -> bool:\n    \"\"\"True when scheme is an exact, supported Azure DevOps auth scheme.\"\"\"\n    return scheme in SUPPORTED","tryCatchPattern":"try:\n    headers = auth.auth_headers(token, entry.auth)\nexcept ValueError as exc:\n    if \"does not support auth scheme\" in str(exc):\n        raise SystemExit(f\"fix auth.json: {exc}\") from exc\n    raise","preventionTips":["Use exactly one of basic-pat, bearer, azure-cli, azure-ad (lowercase) in auth.json.","For plain Azure DevOps PATs against the REST API prefer basic-pat.","Re-check the supported scheme list when upgrading specify-cli."],"tags":["authentication","azure-devops","configuration"],"backgroundTag":null,"analyzedSha":"bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c","analyzedAt":"2026-08-14T19:43:37.150Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}