`omp auth-gateway serve` requires OMP_AUTH_BROKER_URL (or `a

Error message

`omp auth-gateway serve` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). The gateway is itself a broker client.

What it means

`omp auth-gateway serve` proxies broker credentials, so it must itself be configured as a broker client. runServe throws when resolveAuthBrokerConfig() returns null — i.e. neither OMP_AUTH_BROKER_URL nor auth.broker.url/auth.broker.token in config.yml provide broker connection details. This is a fail-fast configuration validation before binding the server.

Source

Thrown at packages/coding-agent/src/cli/auth-gateway-cli.ts:174

 * credentials for, since only those are routable.
 */
export function indexModelsByRequestId(
	models: readonly Model<Api>[],
	providersWithCreds: ReadonlySet<string>,
): Map<string, Model<Api>> {
	const modelById = new Map<string, Model<Api>>();
	for (const model of models) {
		if (!providersWithCreds.has(model.provider)) continue;
		modelById.set(`${model.provider}/${model.id}`, model);
		if (!modelById.has(model.id)) modelById.set(model.id, model);
	}
	return modelById;
}

async function runServe(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
	const brokerConfig = await resolveAuthBrokerConfig();
	if (!brokerConfig) {
		throw new Error(
			"`omp auth-gateway serve` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). The gateway is itself a broker client.",
		);
	}
	const bind = flags.bind ?? DEFAULT_AUTH_GATEWAY_BIND;
	const gatewayToken = flags.noAuth ? null : await ensureToken();

	// Build a broker-backed AuthStorage — same pattern as discoverAuthStorage()
	// in sdk.ts. The gateway never touches local SQLite.
	const accountPool = await loadAuthBrokerAccountPool();
	const client = createBrokerClient(brokerConfig);
	const initialSnapshot = await fetchBrokerSnapshot(client);
	const store = new RemoteAuthCredentialStore({
		client,
		initialSnapshot,
		accountPool,
	});
	// Refresh + usage both flow through the store's broker hooks automatically —
	// `RemoteAuthCredentialStore.refreshOAuthCredential` and `.fetchUsageReports`.

View on GitHub (pinned to 9690622007)

Solutions

Export OMP_AUTH_BROKER_URL (and token if required) before running the command.
Add auth.broker.url and auth.broker.token to config.yml.
Run the command from an environment that loads your dotenv/profile where the broker vars are set.

Example fix

// before (shell)
omp auth-gateway serve
// after (shell)
OMP_AUTH_BROKER_URL=https://broker.example.com OMP_AUTH_BROKER_TOKEN=... omp auth-gateway serve

Defensive patterns

Strategy: validation

Validate before calling

if (!process.env.OMP_AUTH_BROKER_URL) {
  const cfg = await readConfig();
  if (!cfg.auth?.broker?.url) process.exit(1);
}

Type guard

function hasBrokerConfig(c: unknown): c is { url: string; token?: string } {
  return typeof (c as { url?: unknown })?.url === "string";
}

Try / catch

try {
  await $`omp auth-gateway serve`.quiet().nothrow();
} catch (err) {
  if (String(err).includes("requires OMP_AUTH_BROKER_URL")) {
    console.error("Set OMP_AUTH_BROKER_URL or auth.broker.url in config.yml");
  }
}

Prevention

Set OMP_AUTH_BROKER_URL in the deployment env/entrypoint
Keep auth.broker.url/token in config.yml for non-CI environments
Document required env vars in your run scripts

When it happens

Trigger: Running `omp auth-gateway serve` in an environment with no OMP_AUTH_BROKER_URL env var and no auth.broker.url/auth.broker.token keys in config.yml.

Common situations: CI/containers where env vars weren't propagated; fresh checkout without config.yml; running serve on a machine distinct from the one with broker config; typo'd env var name.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/609040df665a829a. Report an issue: GitHub.