{"record":{"id":"ebcea3766c62d972","repo":"coleam00/Archon","slug":"provider-provider-does-not-support-subscripti","errorCode":null,"errorMessage":"Provider '${provider}' does not support subscription login. Subscription providers: ${[...SUBSCRIPTION_PROVIDERS].sort().join(', ')}.","messagePattern":"Provider '(.+?)' does not support subscription login\\. Subscription providers: (.+?)\\.","errorType":"validation","errorClass":"InvalidProviderKeyError","httpStatus":null,"severity":"error","filePath":"packages/core/src/credentials/connect-service.ts","lineNumber":104,"sourceCode":"  kind: 'oauth';\n}\n\n/**\n * Store a user's OAuth subscription credential blob for a vendor. Accepts\n * legacy agent-keyed ids and stores under the vendor-canonical id. Throws\n * {@link InvalidProviderKeyError} when the vendor has no subscription flow\n * (`anthropic`/`openai`/`github-copilot` today). The blob is encrypted inside\n * the store and never logged; it's refreshed on read by\n * `getDecryptedProviderCredential`.\n */\nexport async function persistProviderOAuth(\n  userId: string,\n  provider: string,\n  oauthCreds: OAuthCredentials\n): Promise<PersistProviderOAuthResult> {\n  const vendor = normalizeCredentialVendor(provider);\n  if (!SUBSCRIPTION_PROVIDERS.has(vendor)) {\n    throw new InvalidProviderKeyError(\n      `Provider '${provider}' does not support subscription login. ` +\n        `Subscription providers: ${[...SUBSCRIPTION_PROVIDERS].sort().join(', ')}.`\n    );\n  }\n  await saveUserProviderKey({\n    userId,\n    provider: vendor,\n    kind: 'oauth',\n    oauthCreds,\n    label: 'subscription',\n  });\n  getLog().info({ userId, provider: vendor }, 'provider_oauth.persisted');\n  return { provider: vendor, kind: 'oauth' };\n}\n","sourceCodeStart":86,"sourceCodeEnd":119,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/core/src/credentials/connect-service.ts#L86-L119","documentation":"InvalidProviderKeyError thrown by persistProviderOAuth when the given provider is not in SUBSCRIPTION_PROVIDERS, i.e. it has no OAuth subscription login flow. OAuth subscription credentials are only supported for a fixed set of vendors (anthropic, openai, github-copilot); everything else must be connected with an API key or is not connectable.","triggerScenarios":"Calling persistProviderOAuth(userId, provider, oauthCreds) — directly or via startOAuth — with a provider id outside SUBSCRIPTION_PROVIDERS, such as a community/Pi-backend provider, an ambient vendor, or a typo'd provider string.","commonSituations":"Trying to connect a provider that only supports API keys through the 'subscription login' path; UI/state passing the wrong provider id into the OAuth flow; assuming all listed providers support subscription login when only a subset does.","solutions":["Use a provider from the list in the error message (SUBSCRIPTION_PROVIDERS, sorted).","For non-subscription providers, connect via persistProviderApiKey with an API key instead.","Fix the provider id being passed through your flow — normalize legacy aliases with normalizeCredentialVendor.","If subscription login for a new vendor is genuinely needed, implement its OAuth flow and register it in SUBSCRIPTION_PROVIDERS — don't bypass the guard."],"exampleFix":"// before\nawait persistProviderOAuth(userId, 'amazon-bedrock', creds);\n// after\n// Bedrock is ambient-detected, not subscription:\nawait persistProviderApiKey(userId, 'anthropic', apiKey);","handlingStrategy":"validation","validationCode":"import { SUBSCRIPTION_PROVIDERS } from './oauth-providers';\nimport { normalizeCredentialVendor } from './delivery';\nfunction supportsSubscriptionLogin(provider: string): boolean {\n  return SUBSCRIPTION_PROVIDERS.has(normalizeCredentialVendor(provider));\n}","typeGuard":null,"tryCatchPattern":"try {\n  await persistProviderOAuth(userId, provider, creds);\n} catch (e) {\n  if (e instanceof InvalidProviderKeyError && e.message.includes('does not support subscription login')) {\n    // fall back to API-key connect or surface supported providers\n  } else throw e;\n}","preventionTips":["Gate 'Login with subscription' UI on SUBSCRIPTION_PROVIDERS membership before starting an OAuth flow.","Normalize provider ids before checking subscription support.","Route API-key-only providers to persistProviderApiKey.","List subscription-capable providers from the set, never from a hardcoded array."],"tags":["credentials","oauth","subscription","validation"],"backgroundTag":"oauth-not-supported","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}