{"record":{"id":"be829d0e0161ea1f","repo":"google-gemini/gemini-cli","slug":"failed-to-create-auth-provider-for-agent-defini-be829d","errorCode":null,"errorMessage":"Failed to create auth provider for agent '${definition.name}'","messagePattern":"Failed to create auth provider for agent '(.+?)'","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/remote-invocation.ts","lineNumber":106,"sourceCode":"  getDescription(): string {\n    return `Calling remote agent ${this.definition.displayName ?? this.definition.name}`;\n  }\n\n  private async getAuthHandler(): Promise<AuthenticationHandler | undefined> {\n    if (this.authHandler) {\n      return this.authHandler;\n    }\n\n    if (this.definition.auth) {\n      const targetUrl = getRemoteAgentTargetUrl(this.definition);\n      const provider = await A2AAuthProviderFactory.create({\n        authConfig: this.definition.auth,\n        agentName: this.definition.name,\n        targetUrl,\n        agentCardUrl: this.definition.agentCardUrl,\n      });\n      if (!provider) {\n        throw new Error(\n          `Failed to create auth provider for agent '${this.definition.name}'`,\n        );\n      }\n      this.authHandler = provider;\n    }\n\n    return this.authHandler;\n  }\n\n  protected override async getConfirmationDetails(\n    _abortSignal: AbortSignal,\n  ): Promise<ToolCallConfirmationDetails | false> {\n    // For now, always require confirmation for remote agents until we have a policy system for them.\n    return {\n      type: 'info',\n      title: `Call Remote Agent: ${this.definition.displayName ?? this.definition.name}`,\n      prompt: `Calling remote agent: \"${this.params.query}\"`,\n      onConfirm: async (_outcome: ToolConfirmationOutcome) => {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/remote-invocation.ts#L88-L124","documentation":"Thrown by RemoteAgentInvocation.getAuthHandler() when this.definition.auth is set but A2AAuthProviderFactory.create() returned undefined. Same root cause as the registry guard (error 213), but reached lazily at first call to getAuthHandler() during execute().","triggerScenarios":"execute() -> getAuthHandler() -> A2AAuthProviderFactory.create({ authConfig: definition.auth, ... }) returns undefined. Happens when auth is truthy but yields no provider (empty/incomplete auth block, or the factory declines because agent-card security schemes are unmatched).","commonSituations":"auth: {} or auth without a recognized type; agent card requires a security scheme not satisfied by the provided config; the factory silently returns undefined for unsupported scheme shapes.","solutions":["Fully populate definition.auth with a supported `type` and required fields.","Validate auth config against the agent card's securitySchemes (A2AAuthProviderFactory.validateAuthConfig) before invocation.","Omit auth if the remote agent does not require it.","Cache the provider at registration (registry.ts path) to fail fast rather than at execute time."],"exampleFix":"// before\nauth: { }  // factory returns undefined at execute()\n\n// after\nauth: { type: 'http', scheme: 'bearer', token: '$MY_TOKEN' }","handlingStrategy":"validation","validationCode":"const SUPPORTED = new Set(['google-credentials','apiKey','http','oauth2']);\nfunction assertInvocationAuth(auth) {\n  if (auth && (!auth.type || !SUPPORTED.has(auth.type)))\n    throw new Error('Auth provider cannot be created: missing/unsupported type');\n}","typeGuard":"function isCreatableAuth(a) {\n  return !!a && typeof a.type === 'string' &&\n    ['google-credentials','apiKey','http','oauth2'].includes(a.type);\n}","tryCatchPattern":"try {\n  await invocation.execute(opts);\n} catch (e) {\n  if (e instanceof Error && /Failed to create auth provider/.test(e.message)) {\n    // fix auth config and retry once\n  }\n  throw e;\n}","preventionTips":["Create the auth provider once at registration to fail fast.","Supply a supported auth.type and required fields.","Validate against the agent card's securitySchemes before invocation."],"tags":["a2a","auth","agents","config"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}