coleam00/Archon · error · InvalidProviderKeyError

Provider '${provider}' does not support subscription login.

Error message

Provider '${provider}' does not support subscription login. Subscription providers: ${[...SUBSCRIPTION_PROVIDERS].sort().join(', ')}.

What it means

InvalidProviderKeyError thrown by persistProviderOAuth when the given provider is not in SUBSCRIPTION_PROVIDERS, i.e. it has no OAuth subscription login flow. OAuth subscription credentials are only supported for a fixed set of vendors (anthropic, openai, github-copilot); everything else must be connected with an API key or is not connectable.

Source

Thrown at packages/core/src/credentials/connect-service.ts:104

  kind: 'oauth';
}

/**
 * Store a user's OAuth subscription credential blob for a vendor. Accepts
 * legacy agent-keyed ids and stores under the vendor-canonical id. Throws
 * {@link InvalidProviderKeyError} when the vendor has no subscription flow
 * (`anthropic`/`openai`/`github-copilot` today). The blob is encrypted inside
 * the store and never logged; it's refreshed on read by
 * `getDecryptedProviderCredential`.
 */
export async function persistProviderOAuth(
  userId: string,
  provider: string,
  oauthCreds: OAuthCredentials
): Promise<PersistProviderOAuthResult> {
  const vendor = normalizeCredentialVendor(provider);
  if (!SUBSCRIPTION_PROVIDERS.has(vendor)) {
    throw new InvalidProviderKeyError(
      `Provider '${provider}' does not support subscription login. ` +
        `Subscription providers: ${[...SUBSCRIPTION_PROVIDERS].sort().join(', ')}.`
    );
  }
  await saveUserProviderKey({
    userId,
    provider: vendor,
    kind: 'oauth',
    oauthCreds,
    label: 'subscription',
  });
  getLog().info({ userId, provider: vendor }, 'provider_oauth.persisted');
  return { provider: vendor, kind: 'oauth' };
}

View on GitHub (pinned to 0773b97458)

Solutions

1. Use a provider from the list in the error message (SUBSCRIPTION_PROVIDERS, sorted).
2. For non-subscription providers, connect via persistProviderApiKey with an API key instead.
3. Fix the provider id being passed through your flow — normalize legacy aliases with normalizeCredentialVendor.
4. If subscription login for a new vendor is genuinely needed, implement its OAuth flow and register it in SUBSCRIPTION_PROVIDERS — don't bypass the guard.

Example fix

// before
await persistProviderOAuth(userId, 'amazon-bedrock', creds);
// after
// Bedrock is ambient-detected, not subscription:
await persistProviderApiKey(userId, 'anthropic', apiKey);

import { SUBSCRIPTION_PROVIDERS } from './oauth-providers';
import { normalizeCredentialVendor } from './delivery';
function supportsSubscriptionLogin(provider: string): boolean {
  return SUBSCRIPTION_PROVIDERS.has(normalizeCredentialVendor(provider));
}

try {
  await persistProviderOAuth(userId, provider, creds);
} catch (e) {
  if (e instanceof InvalidProviderKeyError && e.message.includes('does not support subscription login')) {
    // fall back to API-key connect or surface supported providers
  } else throw e;
}

When it happens

Trigger: Calling persistProviderOAuth(userId, provider, oauthCreds) — directly or via startOAuth — with a provider id outside SUBSCRIPTION_PROVIDERS, such as a community/Pi-backend provider, an ambient vendor, or a typo'd provider string.

Common situations: Trying to connect a provider that only supports API keys through the 'subscription login' path; UI/state passing the wrong provider id into the OAuth flow; assuming all listed providers support subscription login when only a subset does.

Related errors

• API key must not be empty.
• Unknown provider '${provider}'. Known: ${listConnectableVend
• Vendor '${vendor}' (Pi backend) has no env-based OAuth deliv
• Pi OAuth provider '${oauthAuth.name}' produced no apiKey for
• No chat in context

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/ebcea3766c62d972. Report an issue: GitHub.