`omp auth-gateway check` requires OMP_AUTH_BROKER_URL (or `a

Error message

`omp auth-gateway check` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). It probes the same credentials the gateway would serve.

What it means

`omp auth-gateway check` probes broker credentials the same way the gateway serves them, so it requires broker configuration. runCheck throws when resolveAuthBrokerConfig() yields null — no OMP_AUTH_BROKER_URL env var and no auth.broker.url/auth.broker.token in config.yml. Fail-fast validation before probing.

Source

Thrown at packages/coding-agent/src/cli/auth-gateway-cli.ts:593

	return chalk.yellow(" [chat: skip]");
}

/**
 * `omp auth-gateway check` — probe each broker-supplied credential and print
 * per-credential auth health. Use this when the gateway is returning 401s and
 * you need to find which row in a multi-account pool is the bad one. The
 * aggregate `/v1/usage` endpoint silently drops failed credentials, so a
 * dedicated diagnostic is the only way to see which credentials failed.
 *
 * Strict mode (`--strict`) additionally exercises each credential against a
 * cheap chat model from its provider's bundled catalog. This catches the case
 * where the usage endpoint reports 200 but the chat endpoint 401s the same
 * bearer (revoked OAuth scope, mislabeled provider row, etc).
 */
async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
	const brokerConfig = await resolveAuthBrokerConfig();
	if (!brokerConfig) {
		throw new Error(
			"`omp auth-gateway check` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). It probes the same credentials the gateway would serve.",
		);
	}

	const accountPool = await loadAuthBrokerAccountPool();
	const client = createBrokerClient(brokerConfig);
	const initialSnapshot = await fetchBrokerSnapshot(client);
	const store = new RemoteAuthCredentialStore({
		client,
		initialSnapshot,
		accountPool,
	});
	const storage = new AuthStorage(store, { sourceLabel: `broker ${brokerConfig.url}` });
	try {
		await storage.reload();
		const results = await storage.checkCredentials(
			flags.strict
				? { completionProbe: createStrictCompletionProbe(), completionTimeoutMs: STRICT_PROBE_OVERALL_TIMEOUT_MS }

View on GitHub (pinned to 9690622007)

Solutions

Export OMP_AUTH_BROKER_URL (plus token) or add auth.broker.url/auth.broker.token to config.yml.
Re-run check in the same shell/environment the gateway runs in so results are representative.

Defensive patterns

Strategy: validation

Validate before calling

const hasBroker = Boolean(process.env.OMP_AUTH_BROKER_URL ?? config.auth?.broker?.url);
if (!hasBroker) { console.error("auth-gateway check needs broker config"); process.exit(1); }

Type guard

function hasBrokerConfig(c: unknown): c is { url: string; token?: string } {
  return typeof (c as { url?: unknown })?.url === "string";
}

Try / catch

try {
  await runCheck(flags);
} catch (err) {
  if (String(err).includes("requires OMP_AUTH_BROKER_URL")) {
    console.error("export OMP_AUTH_BROKER_URL and re-run");
  }
  throw err;
}

Prevention

Run check in the same shell that runs the gateway
Source env files explicitly in scripts (set -a; source .env; set +a)
Validate config.yml keys before invoking CLI commands

When it happens

Trigger: Running `omp auth-gateway check` without broker env vars or config.yml keys.

Common situations: Diagnosing gateway issues on a box that lacks the broker config; forgot to source the env file; new teammate without config setup.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/c06b5830fc00cd89. Report an issue: GitHub.