Pi auth: no credentials for provider '${parsed.provider}'. $

Error message

Pi auth: no credentials for provider '${parsed.provider}'. ${envHint} ${loginHint}

What it means

The Pi session requires credentials for the parsed provider (e.g. anthropic, openai). sendQuery found no auth entry in the Pi auth storage and no matching environment variable, so it throws with a hint naming the env var(s) for that provider (including OAuth-subscription vars like ANTHROPIC_OAUTH_TOKEN) and the `pi /login` fallback.

Source

Thrown at packages/providers/src/community/pi/provider.ts:564

      // We only need the apiKey for the Anthropic subscription-OAuth shape
      // discriminator in step 4c — the SDK reads the credential on its own
      // when sending.
      const resolution = await modelRuntime.getAuth(parsed.provider);
      resolvedKey = resolution?.auth.apiKey;
      hasResolvedAuth = Boolean(resolvedKey);
    }
    if (model) {
      if (!hasResolvedAuth) {
        if (envVarName) {
          // Name the OAuth var first when the backend has one — a subscription
          // user who hits this miss must be told the var the resolver actually
          // prefers (ANTHROPIC_OAUTH_TOKEN), not just the API-key var (#1984).
          const varHint = oauthVarName
            ? `${oauthVarName} (subscription) or ${envVarName}`
            : envVarName;
          const envHint = `Set ${varHint} in the environment or codebase env vars (.archon/config.yaml env: section).`;
          const loginHint = `Or run \`pi\` and type \`/login\` locally to authenticate '${parsed.provider}' via OAuth; credentials land in ~/.pi/agent/auth.json and are picked up automatically.`;
          throw new Error(
            `Pi auth: no credentials for provider '${parsed.provider}'. ${envHint} ${loginHint}`
          );
        }

        // Unmapped providers (LM Studio, ollama, llamacpp, custom
        // OpenAI-compatible endpoints) often don't need credentials at all —
        // log + continue rather than failing fast so local models work without
        // ceremony. If the SDK call later fails for a provider that *does*
        // need creds, the auth_missing breadcrumb is searchable in the log.
        getLog().info(
          {
            piProvider: parsed.provider,
            envHint: `Provider '${parsed.provider}' is not in the Archon adapter's env-var table — file an issue if you want a shortcut env var for it.`,
            loginHint: `Or run \`pi\` and type \`/login\` locally to authenticate '${parsed.provider}' via OAuth; credentials land in ~/.pi/agent/auth.json and are picked up automatically.`,
          },
          'pi.auth_missing'
        );
      }

View on GitHub (pinned to 0773b97458)

Solutions

Export the provider's env var named in the message (or add it under env: in .archon/config.yaml)
For a Claude subscription, set ANTHROPIC_OAUTH_TOKEN rather than only ANTHROPIC_API_KEY
Run `pi` and `/login` so OAuth credentials land in ~/.pi/agent/auth.json
Verify the model ref's provider id matches the provider the credentials are stored under

Example fix

// before
$ archon run workflow   # ANTHROPIC_OAUTH_TOKEN unset
// after
$ export ANTHROPIC_OAUTH_TOKEN=sk-ant-oat...
$ archon run workflow

Defensive patterns

Strategy: validation

Validate before calling

import { readFileSync, existsSync } from 'node:fs';
function piHasCredentials(provider: string): boolean {
  const envVars: Record<string, string> = {
    anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY', google: 'GEMINI_API_KEY',
  };
  if (envVars[provider] && process.env[envVars[provider]]) return true;
  const authPath = `${process.env.HOME}/.pi/agent/auth.json`;
  try {
    const auth = JSON.parse(readFileSync(authPath, 'utf8'));
    return Boolean(auth[provider]);
  } catch { return false; }
}

Type guard

function hasEnvCredentials(varNames: string[]): boolean {
  return varNames.some(v => typeof process.env[v] === 'string' && process.env[v]!.length > 0);
}

Try / catch

try {
  await sendQuery(q);
} catch (err) {
  if (err.message.startsWith('Pi auth: no credentials')) {
    console.error(err.message); // message names the exact env var and /login fallback
    process.exitCode = 1;
  }
  throw err;
}

Prevention

Export provider API keys in deployment env or .archon/config.yaml env: section
For Claude subscriptions set ANTHROPIC_OAUTH_TOKEN, not just ANTHROPIC_API_KEY
Run `pi /login` during machine provisioning
Add a pre-flight credential check per provider before launching workflows

When it happens

Trigger: sendQuery for a provider that needs credentials when auth.json has no entry for parsed.provider and the provider's env var (or codebase env vars from .archon/config.yaml env:) is unset.

Common situations: CI without secrets exported, API keys present but under the wrong variable name (e.g. ANTHROPIC_API_KEY set but the code path wants ANTHROPIC_OAUTH_TOKEN for subscriptions), or the key stored for a different provider id than the model ref uses.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/02f9b2bc457a8d00. Report an issue: GitHub.