different-ai/openwork · error · CloudProviderNeedsCredentialError

`${provider.name} does not have a stored organization creden

Error message

`${provider.name} does not have a stored organization credential yet.`

What it means

When importing a cloud-managed provider, the store resolves the organization's stored credentials for that provider. If no primary API key is stored but the provider's config declares environment-variable entries, it throws CloudProviderNeedsCredentialError naming the provider. The import is aborted because the workspace would end up with an unusable provider.

Source

Thrown at apps/app/src/react-app/domains/connections/provider-auth/store.ts:1684

    const token = settings.authToken?.trim() ?? "";
    const orgId = settings.activeOrgId?.trim() ?? "";
    if (!token || !orgId) {
      throw new Error("Sign in to OpenWork Cloud and choose an organization first.");
    }

    try {
      const den = createDenClient({
        baseUrl: settings.baseUrl,
        token,
      });
      const provider = await den.getOrgLlmProviderConnection(orgId, cloudProviderId);
      const localProviderId = getCloudManagedProviderId(provider);
      assertProviderAllowedByDesktopPolicy(localProviderId);
      const existingImported = state.importedCloudProviders[cloudProviderId] ?? null;
      const { envEntries, primaryApiKey } = resolveCloudProviderCredentials(provider);
      const env = getCloudProviderEnv(provider.providerConfig);
      if (!primaryApiKey && env.length > 0) {
        throw new CloudProviderNeedsCredentialError(
          `${provider.name} does not have a stored organization credential yet.`,
        );
      }

      await assertCloudProviderImportSafe(provider);

      if (envEntries.length > 0) {
        const openworkClient = options.openworkServer.getSnapshot().openworkServerClient;
        if (!openworkClient) {
          throw new CloudProviderNeedsServerError(
            `${provider.name} needs environment variables (${envEntries
              .map((entry) => entry.key)
              .join(", ")}) but the OpenWork server is not available.`,
          );
        }
        await openworkClient.upsertUserEnv(envEntries);
      }
      if (primaryApiKey) {

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Store the provider's API key as an organization credential in OpenWork Cloud (admin/marketplace settings), then retry the import.
2. Catch CloudProviderNeedsCredentialError in the UI and prompt the user/admin to add the org credential.
3. Verify you are in the org that actually holds the credential.
4. Re-sync cloud providers after the credential is added.

Example fix

// before
await store.importCloudProvider(id); // throws CloudProviderNeedsCredentialError
// after
try {
  await store.importCloudProvider(id);
} catch (e) {
  if (e instanceof CloudProviderNeedsCredentialError) {
    promptAdminToStoreOrgCredential(providerName);
  }
}

const { primaryApiKey } = resolveCloudProviderCredentials(provider);
const env = getCloudProviderEnv(provider.providerConfig);
if (!primaryApiKey && env.length > 0) promptOrgCredentialSetup(provider.name);

function hasOrgCredential(p: { name: string }): boolean {
  return Boolean(resolveCloudProviderCredentials(p).primaryApiKey);
}

try {
  await store.importCloudProvider(cloudProviderId);
} catch (e) {
  if (e instanceof CloudProviderNeedsCredentialError) {
    showOrgCredentialPrompt(e.message);
  }
}

When it happens

Trigger: Importing a provider whose org credential was never set (or was deleted) in OpenWork Cloud while its providerConfig requires env vars; syncing cloud providers after an admin removed the org-level key.

Common situations: New provider added to the org marketplace without storing its key; key rotated/removed server-side; user imports from a different org that lacks the credential.

Related errors

• Sign in to OpenWork Cloud and choose an organization first.
• An enterprise MCP server URL cannot contain embedded credent
• Invalid cloud provider sync response.
• Invalid cloud provider sync status.
• Invalid cloud provider sync status response.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/8b0715fb8f2913c1. Report an issue: GitHub.