Security scans require a stored OAuth account for ${provider

Error message

Security scans require a stored OAuth account for ${provider}

What it means

selectSecurityAccount looks up stored OAuth accounts for the given provider (optionally scoped to a session). If none exist at all, it throws this error because security scans require an authenticated account to run under.

Source

Thrown at packages/coding-agent/src/security/auth.ts:45

		(account.organizationName !== undefined && account.organizationName !== resolution.orgName)
	) {
		throw new Error("Security scan authentication identity mismatch");
	}
}

export function selectSecurityAccount(
	authStorage: AuthStorage,
	provider: string,
	requestedCredentialId?: number,
	sessionId?: string,
): SecurityAccountRef {
	const accounts = authStorage.listOAuthAccounts(provider, sessionId);
	const selected =
		requestedCredentialId !== undefined
			? accounts.find(account => account.credentialId === requestedCredentialId)
			: (accounts.find(account => account.active) ?? (accounts.length === 1 ? accounts[0] : undefined));
	if (!selected) {
		if (accounts.length === 0) throw new Error(`Security scans require a stored OAuth account for ${provider}`);
		if (requestedCredentialId !== undefined) {
			throw new Error(`Security OAuth credential ${requestedCredentialId} is not available for ${provider}`);
		}
		throw new Error(
			`Multiple OAuth accounts are available for ${provider}; supply credentialId to pin one exact account`,
		);
	}
	const account: SecurityAccountRef = { provider, credentialId: selected.credentialId };
	if (selected.accountId !== undefined) account.accountId = selected.accountId;
	if (selected.email !== undefined) account.email = selected.email;
	if (selected.orgId !== undefined) account.organizationId = selected.orgId;
	if (selected.orgName !== undefined) account.organizationName = selected.orgName;
	return account;
}

export async function resolveExactSecurityOAuthAccess(
	authStorage: AuthStorage,
	account: SecurityAccountRef,

View on GitHub (pinned to 9690622007)

Solutions

Complete the OAuth login flow for the provider so an account is stored
Check you are passing the right provider name and sessionId
Copy/import credentials into the auth storage if migrating environments

Example fix

// before
await runScan({ provider: "github" }); // no stored OAuth account
// after
await authenticateProvider("github"); // OAuth flow first
await runScan({ provider: "github" });

Defensive patterns

Strategy: validation

Validate before calling

const accounts = authStorage.listOAuthAccounts(provider, sessionId);
if (accounts.length === 0) {
  throw new Error(`no stored OAuth account for ${provider}; run the login flow first`);
}

Type guard

null

Try / catch

try {
  const account = selectSecurityAccount(authStorage, provider, requestedCredentialId, sessionId);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Security scans require a stored OAuth account")) {
    await runOAuthLogin(provider);
  } else throw err;
}

Prevention

Run the OAuth login flow for each provider before enabling security scans
In CI, provision credentials into auth storage before the scan step
Double-check provider name spelling and sessionId scoping

When it happens

Trigger: Requesting a security scan for a provider that has zero OAuth accounts in authStorage (for that session id).

Common situations: Never having run the OAuth login flow for the provider; scanning in a fresh environment/container without copied credentials; session-scoped accounts not visible to the current session id.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/bc2ef87edacbc492. Report an issue: GitHub.