{"record":{"id":"ff924fbe8c91b317","repo":"google-gemini/gemini-cli","slug":"failed-to-create-auth-provider-for-agent-this-d","errorCode":null,"errorMessage":"Failed to create auth provider for agent '${this.definition.name}'","messagePattern":"Failed to create auth provider for agent '(.+?)'","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/remote-subagent-protocol.ts","lineNumber":302,"sourceCode":"    this._resultResolve({\n      llmContent: [{ text: finalOutput }],\n      returnDisplay: finalProgress,\n    });\n  }\n\n  private async _getAuthHandler(): Promise<AuthenticationHandler | undefined> {\n    if (this.authHandler) return this.authHandler;\n    if (!this.definition.auth) return undefined;\n\n    const targetUrl = getRemoteAgentTargetUrl(this.definition);\n    const provider = await A2AAuthProviderFactory.create({\n      authConfig: this.definition.auth,\n      agentName: this.definition.name,\n      targetUrl,\n      agentCardUrl: this.definition.agentCardUrl,\n    });\n    if (!provider) {\n      throw new Error(\n        `Failed to create auth provider for agent '${this.definition.name}'`,\n      );\n    }\n    this.authHandler = provider;\n    return this.authHandler;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Internal helpers\n  // ---------------------------------------------------------------------------\n\n  private _emit(events: AgentEvent[]): void {\n    if (events.length === 0) return;\n    const subscribers = [...this._subscribers];\n    for (const event of events) {\n      this._events.push(event);\n      if (event.type === 'agent_end') {\n        this._agentEndEmitted = true;","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/remote-subagent-protocol.ts#L284-L320","documentation":"Thrown by RemoteSubagentProtocol._getAuthHandler() when A2AAuthProviderFactory.create() returns undefined despite definition.auth being set. The factory returns undefined when authConfig is falsy or when an AgentCard declares security schemes but no authConfig was provided to match them. Since _getAuthHandler only calls the factory when definition.auth is truthy, the undefined return indicates the factory could not build a provider for the given auth type — most commonly because the agent card requires authentication schemes the configured auth does not satisfy.","triggerScenarios":"A remote agent definition has an auth block set, but A2AAuthProviderFactory.create() returns undefined. This happens when definition.auth is present yet the factory's internal logic cannot map it to a concrete provider — e.g., the agent card's securitySchemes are non-empty but authConfig doesn't match any, or the factory's early-return paths fire.","commonSituations":"Misconfigured auth block in a remote agent definition (e.g., type field missing or typo'd); agent card requires OAuth2 but auth config only specifies apiKey; version mismatch where the factory was updated to require additional fields (targetUrl, agentCardUrl) that the definition doesn't provide; JSON-based agent card whose security schemes differ from what the auth config targets.","solutions":["Inspect the agent definition's auth block: ensure type is one of 'google-credentials', 'apiKey', 'http', or 'oauth2' and all required fields for that type are present.","Run A2AAuthProviderFactory.validateAuthConfig(authConfig, agentCard.securitySchemes) before starting the stream to catch scheme mismatches early.","Verify that the agent card's securitySchemes are satisfiable by the configured auth type; adjust either the card or the auth config to match.","If the agent requires no auth, remove the auth block from the definition rather than leaving an incomplete one."],"exampleFix":"// before — auth block present but factory returns undefined\nconst def: RemoteAgentDefinition = {\n  name: 'my-agent',\n  auth: { type: 'apiKey' }, // missing required fields\n  agentCardUrl: 'https://...',\n};\n\n// after — validate against card schemes first\nconst result = A2AAuthProviderFactory.validateAuthConfig(def.auth, card.securitySchemes);\nif (!result.valid) {\n  throw new Error(`Auth misconfigured: ${result.diff?.missingConfig.join(', ')}`);\n}","handlingStrategy":"validation","validationCode":"// Validate auth config against the agent card before starting the stream\nconst result = A2AAuthProviderFactory.validateAuthConfig(\n  definition.auth,\n  agentCard?.securitySchemes,\n);\nif (!result.valid) {\n  throw new Error(\n    `Auth misconfigured for '${definition.name}': ${result.diff?.missingConfig.join(', ')}`\n  );\n}","typeGuard":"import type { A2AAuthConfig } from './auth-provider/types.js';\n\nfunction hasValidAuthConfig(\n  def: RemoteAgentDefinition\n): def is RemoteAgentDefinition & { auth: A2AAuthConfig } {\n  return def.auth != null && typeof def.auth.type === 'string';\n}","tryCatchPattern":"try {\n  await protocol.send(query);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Failed to create auth provider')) {\n    // Prompt user to reconfigure auth for this agent\n    return { error: `Reconfigure authentication for agent '${name}'.` };\n  }\n  throw e;\n}","preventionTips":["Run validateAuthConfig at agent registration time, not just at call time.","Document required auth fields for each auth type in agent definition schemas.","Test each auth type (apiKey, http, oauth2, google-credentials) in isolation.","Add Zod schema validation for the auth block to catch missing fields early."],"tags":["a2a","authentication","auth-provider","configuration"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}