{"record":{"id":"dc58b26442294305","repo":"vercel/ai","slug":"both-apikey-and-authtoken-were-provided-please-us","errorCode":null,"errorMessage":"Both apiKey and authToken were provided. Please use only one authentication method.","messagePattern":"Both apiKey and authToken were provided\\. Please use only one authentication method\\.","errorType":"validation","errorClass":"InvalidArgumentError","httpStatus":null,"severity":"error","filePath":"packages/anthropic/src/anthropic-provider.ts","lineNumber":130,"sourceCode":"/**\n * Create an Anthropic provider instance.\n */\nexport function createAnthropic(\n  options: AnthropicProviderSettings = {},\n): AnthropicProvider {\n  const baseURL =\n    normalizeBaseURL(\n      loadOptionalSetting({\n        settingValue: options.baseURL,\n        environmentVariableName: 'ANTHROPIC_BASE_URL',\n      }),\n    ) ?? ANTHROPIC_API_VERSIONED_URL;\n\n  const providerName = options.name ?? 'anthropic.messages';\n\n  // Only error if both are explicitly provided in options\n  if (options.apiKey && options.authToken) {\n    throw new InvalidArgumentError({\n      argument: 'apiKey/authToken',\n      message:\n        'Both apiKey and authToken were provided. Please use only one authentication method.',\n    });\n  }\n\n  const getHeaders = () => {\n    const authHeaders: Record<string, string> = options.authToken\n      ? { Authorization: `Bearer ${options.authToken}` }\n      : {\n          'x-api-key': loadApiKey({\n            apiKey: options.apiKey,\n            environmentVariableName: 'ANTHROPIC_API_KEY',\n            description: 'Anthropic',\n          }),\n        };\n\n    return withUserAgentSuffix(","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/anthropic/src/anthropic-provider.ts#L112-L148","documentation":"createAnthropic throws InvalidArgumentError when both `apiKey` and `authToken` are present in the options object. The Anthropic provider supports two mutually exclusive authentication methods: an API key (sent as x-api-key) and an OAuth bearer token (sent as Authorization: Bearer). Providing both is ambiguous, so the provider fails fast at construction time rather than guessing which credential to use.","triggerScenarios":"Calling createAnthropic({ apiKey: '...', authToken: '...' }) with both fields set explicitly in the options object, e.g. merging env vars and an OAuth token config without clearing the unused one.","commonSituations":"Config objects built by spreading multiple sources (env, secrets manager, per-request auth) where a previous apiKey lingers; migrating from API-key auth to OAuth tokens without removing the old key; shared provider factories that always pass both fields.","solutions":["Remove one of the two fields: keep `apiKey` for standard API-key auth or `authToken` for OAuth/token-based auth, not both.","Conditionally build the options object so only the available credential is passed (e.g. authToken ? { authToken } : { apiKey }).","Check environment variables for stray ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN values that get merged into options."],"exampleFix":"// before\nconst anthropic = createAnthropic({\n  apiKey: process.env.ANTHROPIC_API_KEY,\n  authToken: oauthToken,\n});\n// after\nconst anthropic = createAnthropic(\n  oauthToken\n    ? { authToken: oauthToken }\n    : { apiKey: process.env.ANTHROPIC_API_KEY! },\n);","handlingStrategy":"validation","validationCode":"const opts = buildAnthropicOptions();\nif (opts.apiKey && opts.authToken) {\n  throw new Error('Provide either apiKey or authToken, not both');\n}\nconst anthropic = createAnthropic(opts);","typeGuard":null,"tryCatchPattern":"try {\n  const anthropic = createAnthropic(options);\n} catch (error) {\n  if (InvalidArgumentError.isInstance(error)) {\n    console.error('Anthropic auth config invalid:', error.message);\n  }\n  throw error;\n}","preventionTips":["Build provider options from a single credential source with an explicit precedence (token over key).","Assert exactly one of apiKey/authToken is set in config load tests.","Avoid blind object spreading when merging env and secret-manager values."],"tags":["configuration","authentication","provider-setup"],"backgroundTag":"conflicting-auth-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}