{"record":{"id":"ab1d19f75ced1f39","repo":"langchain-ai/deepagents","slug":"no-credentials-are-configured-for-any-model-in-mod","errorCode":null,"errorMessage":"No credentials are configured for any model in models.allowed. Add credentials for one of: {allowed}.","messagePattern":"No credentials are configured for any model in models\\.allowed\\. Add credentials for one of: (.+?)\\.","errorType":"exception","errorClass":"NoAllowedModelCredentialsError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/config.py","lineNumber":5125,"sourceCode":"            # deliberately permits that state.\n            if auth.state is not ProviderAuthState.MISSING:\n                return candidate\n        if not candidates:\n            # Every entry is a wildcard for a provider with no discoverable\n            # models, so there is nothing to credential.\n            allowed = \", \".join(config.allowed_models)\n            msg = (\n                \"No discoverable models match models.allowed \"\n                f\"({allowed}). Name an exact provider:model spec or configure \"\n                \"models for a wildcarded provider.\"\n            )\n            raise NoAllowedModelCredentialsError(msg)\n        allowed = \", \".join(candidates)\n        msg = (\n            \"No credentials are configured for any model in models.allowed. \"\n            f\"Add credentials for one of: {allowed}.\"\n        )\n        raise NoAllowedModelCredentialsError(msg)\n\n    # `is True` deliberately excludes `ProviderAuthState.UNKNOWN` (which maps\n    # to `as_legacy_bool() -> None`). For the three explicit-credential\n    # providers below, an UNKNOWN result means we cannot prove auth works, so\n    # we fall through rather than pick an unverifiable default. If an\n    # implicit-auth provider (e.g., Vertex ADC) is added to this fallback\n    # list, switch to checking `state` against the relevant\n    # `ProviderAuthState` members directly.\n    if get_provider_auth_status(\"openai\").as_legacy_bool() is True:\n        return \"openai:gpt-5.6-terra\"\n    if get_provider_auth_status(\"anthropic\").as_legacy_bool() is True:\n        return \"anthropic:claude-opus-5\"\n    if get_provider_auth_status(\"google_genai\").as_legacy_bool() is True:\n        return \"google_genai:gemini-3.1-pro-preview\"\n\n    msg = (\n        \"No credentials configured. Please set one of: \"\n        \"ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_API_KEY\"","sourceCodeStart":5107,"sourceCodeEnd":5143,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/config.py#L5107-L5143","documentation":"Raised when `models.allowed` is configured in config.toml but none of the allowlisted models have usable credentials. It is a `NoCredentialsConfiguredError` subclass so deferred-start paths still prompt for credentials, but it is distinct because only a credential for an allowlisted provider can resolve it — adding credentials for a non-allowlisted provider will not help.","triggerScenarios":"Calling the default-model resolution function when: (1) `models.allowed` is set, (2) the stored default/recent model is absent or outside the policy, and (3) `get_provider_auth_status` returns `ProviderAuthState.MISSING` for every expanded candidate from the allowlist (config.py:5100-5125).","commonSituations":"Setting `models.allowed = [\"anthropic:*\"]` but never running `/auth` or exporting ANTHROPIC_API_KEY; switching machines or CI containers without copying credentials; allowlisting a provider whose key env var is not set in the execution environment.","solutions":["Add credentials for one of the models listed in the message: run `/auth` or export the provider's key (ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, ...)","Remove or widen `models.allowed` in config.toml if the policy no longer matches providers you can credential","Verify the key is visible in the environment where dcode runs (`echo $ANTHROPIC_API_KEY`), not only in an unsourced shell profile"],"exampleFix":"// before (config.toml)\n[models]\nallowed = [\"anthropic:claude-opus-5\"]\n# ANTHROPIC_API_KEY unset\n\n// after\n$ export ANTHROPIC_API_KEY=sk-ant-...\n$ dcode   # resolves anthropic:claude-opus-5","handlingStrategy":"validation","validationCode":"import os\nfrom deepagents_code.model_config import ModelConfig, get_provider_auth_status, ProviderAuthState, ModelSpec\n\ncfg = ModelConfig.load()\nif cfg.allowed_models is not None:\n    for entry in cfg.allowed_models:\n        for spec in [entry] if \":\" in entry else [entry]:\n            provider = ModelSpec.parse(spec).provider\n            if get_provider_auth_status(provider).state == ProviderAuthState.MISSING:\n                print(f\"Set credentials for {provider} before launch\")","typeGuard":"def has_allowlisted_credentials(cfg) -> bool:\n    from deepagents_code.model_config import ProviderAuthState, get_provider_auth_status, ModelSpec\n    if cfg.allowed_models is None:\n        return True\n    return any(\n        get_provider_auth_status(ModelSpec.parse(s).provider).state\n        is not ProviderAuthState.MISSING\n        for entry in cfg.allowed_models\n        for s in ([entry] if \":\" in entry else [entry])\n    )","tryCatchPattern":"from deepagents_code.model_config import NoAllowedModelCredentialsError\ntry:\n    model_spec = resolve_default_model_spec()\nexcept NoAllowedModelCredentialsError as e:\n    print(f\"Configure credentials for an allowlisted provider: {e}\")\n    # Do NOT silently retry: only an allowlisted provider's credential resolves this.","preventionTips":["Keep `models.allowed` in sync with the providers you actually credential","Run `/auth` right after changing the allowlist","In CI, inject provider key env vars via secrets before launching dcode"],"tags":["config","credentials","model-policy","startup"],"backgroundTag":"missing-model-credentials","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}