crewAIInc/crewAI · error · ValueError

Authorization callback not set. Use set_authorization_callba

Error message

Authorization callback not set. Use set_authorization_callback()

What it means

In crewai's A2A OAuth2 client scheme, the Authorization header flow needs a way to obtain the first access token. If no token is cached (_access_token is None) and no authorization callback has been registered via set_authorization_callback(), apply_auth raises ValueError because it has no mechanism to get consent from the user.

Source

Thrown at lib/crewai/src/crewai/a2a/auth/client_schemes.py:466

        """Apply OAuth2 access token to Authorization header.

        Uses asyncio.Lock to ensure only one coroutine handles token operations
        (initial fetch or refresh) at a time.

        Args:
            client: HTTP client for making token requests.
            headers: Current request headers.

        Returns:
            Updated headers with OAuth2 access token in Authorization header.

        Raises:
            ValueError: If authorization callback is not set.
        """
        if self._access_token is None:
            if self._authorization_callback is None:
                msg = "Authorization callback not set. Use set_authorization_callback()"
                raise ValueError(msg)
            async with self._lock:
                if self._access_token is None:
                    await self._fetch_initial_token(client)
        elif self._token_expires_at and time.time() >= self._token_expires_at:
            async with self._lock:
                if self._token_expires_at and time.time() >= self._token_expires_at:
                    await self._refresh_access_token(client)

        if self._access_token:
            headers["Authorization"] = f"Bearer {self._access_token}"

        return headers

    async def _fetch_initial_token(self, client: httpx.AsyncClient) -> None:
        """Fetch initial access token using authorization code flow.

        Args:
            client: HTTP client for making token request.

View on GitHub (pinned to 754d7323be)

Solutions

Register a callback before the first request: scheme.set_authorization_callback(async_callback) where the callback receives the auth URL and returns the authorization code.
Alternatively pre-seed a token if the API supports it, so _access_token is not None on first use.
Make callback registration part of scheme construction in your setup code.

Example fix

# before
scheme = OAuth2ClientScheme(...)
await client.send(request)  # first auth -> ValueError: callback not set

# after
async def consent(auth_url: str) -> str:
    webbrowser.open(auth_url)
    return input('Paste authorization code: ')

scheme = OAuth2ClientScheme(...)
scheme.set_authorization_callback(consent)
await client.send(request)

Defensive patterns

Strategy: validation

Validate before calling

scheme = OAuth2ClientScheme(...)
if scheme._access_token is None and scheme._authorization_callback is None:
    raise SystemExit('Register a callback: scheme.set_authorization_callback(cb)')

Type guard

def oauth2_ready(scheme) -> bool:
    return getattr(scheme, '_access_token', None) is not None or getattr(scheme, '_authorization_callback', None) is not None

Try / catch

try:
    headers = await scheme.apply_auth(client, headers)
except ValueError as e:
    if 'Authorization callback not set' in str(e):
        scheme.set_authorization_callback(consent_cb)
        headers = await scheme.apply_auth(client, headers)
    else:
        raise

Prevention

Register the authorization callback immediately after constructing the scheme.
Encapsulate scheme setup in a factory that always sets callback or token.
Add a pre-flight check for callback/token before the first A2A request.

When it happens

Trigger: Using an OAuth2 client scheme (authorization code flow) for A2A connections and calling the header/auth step before ever calling set_authorization_callback(cb), or after resetting the callback; i.e., first request without prior setup.

Common situations: Wiring an agent-to-agent OAuth2 integration and forgetting the interactive consent step; porting from an API-key scheme where no callback was needed; callback set on a different scheme instance than the one used.

Related errors

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/22a4822a6dcd4bbc. Report an issue: GitHub.