What causes "Invalid auth provider" in chroma-core/chroma?

Use one of the two supported literals: provider: 'basic' or provider: 'token'.

chroma-core/chroma · error · Error

Invalid auth provider

Error message

Invalid auth provider

What it means

The switch in authOptionsToAuthProvider only recognizes 'basic' and 'token'; any other provider string falls through to default and throws 'Invalid auth provider'. AuthOptions.provider is typed ClientAuthProvider | string | undefined, so TypeScript will NOT catch a misspelled or unsupported value - the failure happens at runtime, during client construction.

Source

Thrown at clients/js/packages/chromadb-core/src/auth.ts:103

  auth: AuthOptions,
): ClientAuthProvider => {
  if (auth.provider === undefined) {
    throw new Error("Auth provider not specified");
  }
  if (auth.credentials === undefined) {
    throw new Error("Auth credentials not specified");
  }
  switch (auth.provider) {
    case "basic":
      return new BasicAuthClientProvider(auth.credentials);
    case "token":
      return new TokenAuthClientProvider(
        auth.credentials,
        auth.tokenHeaderType,
      );
      break;
    default:
      throw new Error("Invalid auth provider");
  }
};

View on GitHub (pinned to aecdd12c8a)

Solutions

Use one of the two supported literals: provider: 'basic' or provider: 'token'.
Restrict your own config type to a union ('basic' | 'token') so invalid values fail at compile time.
If you need a custom scheme, implement ClientAuthProvider (authenticate(): AuthHeaders) and wire the headers yourself instead of passing an unknown string.

Example fix

// before
new ChromaClient({ auth: { provider: 'bearer', credentials: tok } });

// after
new ChromaClient({ auth: { provider: 'token', credentials: tok } });

Defensive patterns

Strategy: type-guard

Validate before calling

const SUPPORTED = ['basic', 'token'] as const;
if (!SUPPORTED.includes(auth.provider as (typeof SUPPORTED)[number])) {
  throw new Error(`Unsupported auth provider '${auth.provider}'; use basic or token`);
}

Type guard

type SupportedProvider = 'basic' | 'token';
function isSupportedProvider(v: unknown): v is SupportedProvider {
  return v === 'basic' || v === 'token';
}

Try / catch

try {
  new ChromaClient({ auth });
} catch (e) {
  if (e instanceof Error && e.message === 'Invalid auth provider') {
    // map your scheme to 'basic' or 'token', or implement ClientAuthProvider manually
  }
  throw e;
}

Prevention

Restrict your own config type to provider: 'basic' | 'token' so typos fail at compile time.
Do not copy server-side provider class names into client auth options.
For custom schemes, implement ClientAuthProvider and set headers via fetchOptions instead of auth.provider.

When it happens

Trigger: auth: { provider: 'apikey', ... }; provider: 'tokens' or 'Token' (case/typo); provider: 'oidc' or another scheme the JS client does not implement; provider passed as a provider instance instead of the literal string.

Common situations: Copying auth config from Chroma server docs that list server-side providers (e.g. 'chromadb.auth.token_authn.TokenAuthenticationServerProvider') into the client options; version drift where a provider exists in Python but not in the JS client.

Related errors

AI-assisted analysis of chroma-core/chroma@aecdd12c8a (2026-08-16). Data as JSON: /api/errors/3a58321d073d0464. Report an issue: GitHub.