Vendor '${vendor}' (Pi backend) has no env-based OAuth deliv

Error message

Vendor '${vendor}' (Pi backend) has no env-based OAuth delivery; subscriptions reach Pi via auth.json.

What it means

Thrown by deliverCredential when it resolves an oauth-kind stored credential for a vendor that maps to a Pi backend env var. Pi backends consume subscriptions through the aggregate auth.json (buildPiAuthJson), not per-vendor env delivery, so an oauth row on that path indicates a connect-layer bug: oauth rows should only exist for anthropic/openai/github-copilot.

Source

Thrown at packages/core/src/credentials/delivery.ts:198

      return {
        env: {
          COPILOT_GITHUB_TOKEN: cred.kind === 'api_key' ? cred.apiKey : cred.oauthApiKey,
        },
      };

    default: {
      // Happy path first: any vendor in the generated env map delivers its
      // API key. This includes google-vertex, which is BOTH api_key-capable
      // and ambient — a stored Vertex key must deliver, so the env lookup
      // takes precedence over the ambient check.
      const piEnvVar = PI_PROVIDER_ENV_VARS[vendor];
      if (piEnvVar) {
        if (cred.kind === 'oauth') {
          // Reached only if an oauth row exists under a Pi-backend id (connect
          // guards against this — oauth is anthropic/openai/github-copilot
          // only). The Pi runtime consumes subscriptions via the aggregate
          // auth.json (buildPiAuthJson), not this per-vendor env path.
          throw new Error(
            `Vendor '${vendor}' (Pi backend) has no env-based OAuth delivery; subscriptions reach Pi via auth.json.`
          );
        }
        return { env: { [piEnvVar]: cred.apiKey } };
      }
      if (PI_AMBIENT_VENDORS.includes(vendor)) {
        // Ambient-ONLY vendors (amazon-bedrock — no env var in the map):
        // chains are detected from the environment, never stored — a stored
        // row for one is a connect bug.
        throw new Error(
          `Vendor '${vendor}' uses ambient cloud credentials and has no stored-credential delivery.`
        );
      }
      throw new Error(
        `Unknown credential vendor '${vendor}'. Known: ${[...KNOWN_VENDORS].sort().join(', ')}.`
      );
    }
  }

View on GitHub (pinned to 0773b97458)

Solutions

Remove or correct the stored oauth row for that vendor — connect only allows oauth for anthropic/openai/github-copilot.
Reconnect the provider through the supported path (subscription login for supported vendors, API key otherwise).
If this is a Pi-backend provider, ensure Pi receives subscriptions via buildPiAuthJson/auth.json, not an env-delivered oauth credential.
Audit for code paths that persist OAuth blobs without the connect-time SUBSCRIPTION_PROVIDERS guard.

Example fix

// before (row exists: vendor='groq', kind='oauth')
deliverCredential('groq', oauthCred); // throws
// after
deliverCredential('groq', { kind: 'api_key', apiKey });

Defensive patterns

Strategy: validation

Validate before calling

const OAUTH_ALLOWED = new Set(['anthropic', 'openai', 'github-copilot']);
function canStoreOAuth(vendor: string): boolean {
  return OAUTH_ALLOWED.has(normalizeCredentialVendor(vendor));
}

Try / catch

try {
  const r = deliverCredential(vendor, cred);
} catch (e) {
  if ((e as Error).message.includes('no env-based OAuth delivery')) {
    // the stored row is invalid: flag for reconnect, never retry as-is
  } else throw e;
}

Prevention

Only persist OAuth blobs through persistProviderOAuth, which enforces SUBSCRIPTION_PROVIDERS.
Never insert credential rows into the DB directly in scripts or migrations.
Assert credential kind matches the vendor's allowed kinds before saving.
Treat this error as a data-corruption signal: reconnect the provider, don't work around delivery.

When it happens

Trigger: deliverCredential(vendor, { kind: 'oauth', ... }) where the vendor has a piEnvVar — caused by an oauth credential row stored under a Pi-backend vendor id, bypassing connect-time guards (e.g. hand-inserted DB rows, a migration, or a code path that stores OAuth blobs for arbitrary vendors).

Common situations: Directly manipulating the credentials table; a custom integration storing OAuth output from a non-subscription provider; a regression in connect guards letting an oauth row land under a Pi-backend id.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/cfdc4c8761adbb41. Report an issue: GitHub.