{"record":{"id":"cd6b64f6a2f96e9b","repo":"google-gemini/gemini-cli","slug":"failed-to-create-auth-provider-for-agent-defini","errorCode":null,"errorMessage":"Failed to create auth provider for agent '${definition.name}'","messagePattern":"Failed to create auth provider for agent '(.+?)'","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/registry.ts","lineNumber":510,"sourceCode":"    try {\n      const clientManager = this.config.getA2AClientManager();\n      if (!clientManager) {\n        debugLogger.warn(\n          `[AgentRegistry] Skipping remote agent '${definition.name}': A2AClientManager is not available.`,\n        );\n        return;\n      }\n      const targetUrl = getRemoteAgentTargetUrl(remoteDef);\n      let authHandler: AuthenticationHandler | undefined;\n      if (definition.auth) {\n        const provider = await A2AAuthProviderFactory.create({\n          authConfig: definition.auth,\n          agentName: definition.name,\n          targetUrl,\n          agentCardUrl: remoteDef.agentCardUrl,\n        });\n        if (!provider) {\n          throw new Error(\n            `Failed to create auth provider for agent '${definition.name}'`,\n          );\n        }\n        authHandler = provider;\n      }\n\n      const agentCard = await clientManager.loadAgent(\n        remoteDef.name,\n        getAgentCardLoadOptions(remoteDef),\n        authHandler,\n      );\n\n      // Validate auth configuration against the agent card's security schemes.\n      if (agentCard.securitySchemes) {\n        const validation = A2AAuthProviderFactory.validateAuthConfig(\n          definition.auth,\n          agentCard.securitySchemes,\n        );","sourceCodeStart":492,"sourceCodeEnd":528,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/registry.ts#L492-L528","documentation":"Thrown in AgentRegistry remote-agent registration when definition.auth is set but A2AAuthProviderFactory.create() returned undefined. The factory returns undefined only when authConfig is absent/empty or when the agent card exposes security schemes that are not covered by config — so this guard fires when the auth block is truthy yet produces no provider (e.g. empty object, or a type the factory silently skips).","triggerScenarios":"registerRemoteAgent with definition.auth truthy (e.g. auth: {} or an object the factory does not turn into a provider); factory.create({...definition.auth}) returns undefined because authConfig resolved to undefined/empty after destructuring, or the agent card has security schemes and config is insufficient.","commonSituations":"auth: {} placeholder in the agent config; auth object present but its `type` field missing or empty so the factory treats it as no-config; security scheme mismatch where the factory declines to build.","solutions":["Populate definition.auth fully — at minimum a recognized `type` ('google-credentials' | 'apiKey' | 'http' | 'oauth2').","Ensure the auth type is one the factory supports (note 'openIdConnect' throws 'not yet implemented' rather than returning undefined).","Remove the auth block entirely if the remote agent does not require authentication.","Inspect agentCard.securitySchemes and supply matching config fields."],"exampleFix":"// before\nauth: { }   // truthy but no type -> factory returns undefined\n\n// after\nauth: { type: 'apiKey', apiKey: '$MY_API_KEY', location: 'header', name: 'X-API-Key' }","handlingStrategy":"validation","validationCode":"const SUPPORTED = new Set(['google-credentials','apiKey','http','oauth2']);\nfunction assertAuth(auth) {\n  if (auth && !SUPPORTED.has(auth.type))\n    throw new Error(`Unsupported auth type: ${auth?.type}`);\n  if (auth && !auth.type)\n    throw new Error('auth.type is required');\n}","typeGuard":"function hasSupportedAuthType(a) {\n  return !!a && typeof a.type === 'string' &&\n    ['google-credentials','apiKey','http','oauth2'].includes(a.type);\n}","tryCatchPattern":"try {\n  await registerRemoteAgent(def);\n} catch (e) {\n  if (e instanceof Error && /Failed to create auth provider/.test(e.message)) {\n    // fix def.auth.type / fields, then re-register\n  }\n  throw e;\n}","preventionTips":["Always set auth.type to a supported value when defining auth.","Validate auth config against agentCard.securitySchemes via A2AAuthProviderFactory.validateAuthConfig.","Omit auth entirely for unauthenticated agents."],"tags":["a2a","auth","config","agents"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}