gastownhall/beads · error

ado.pat not configured: set via 'bd config set ado.pat <toke

Error message

ado.pat not configured: set via 'bd config set ado.pat <token>' or AZURE_DEVOPS_PAT env var

What it means

validateADOConfig requires an Azure DevOps PAT before any ADO command can talk to the service. When cfg.PAT is empty this error explains both configuration channels: the `bd config set ado.pat <token>` key or the AZURE_DEVOPS_PAT environment variable. It fails fast before any network call.

Source

Thrown at cmd/bd/ado.go:243

	case "ado.pat":
		return "AZURE_DEVOPS_PAT"
	case "ado.org":
		return "AZURE_DEVOPS_ORG"
	case "ado.project":
		return "AZURE_DEVOPS_PROJECT"
	case "ado.projects":
		return "AZURE_DEVOPS_PROJECTS"
	case "ado.url":
		return "AZURE_DEVOPS_URL"
	default:
		return ""
	}
}

// validateADOConfig checks that required configuration is present.
func validateADOConfig(cfg ADOConfig) error {
	if cfg.PAT == "" {
		return fmt.Errorf("ado.pat not configured: set via 'bd config set ado.pat <token>' or AZURE_DEVOPS_PAT env var")
	}
	if cfg.Org == "" && cfg.URL == "" {
		return fmt.Errorf("ado.org not configured: set via 'bd config set ado.org <org>' or AZURE_DEVOPS_ORG env var")
	}
	if len(cfg.Projects) == 0 {
		return fmt.Errorf("no ADO project configured\nSet via 'bd config set ado.project <project>'\nOr:  'bd config set ado.projects \"proj1,proj2\"'\nOr: AZURE_DEVOPS_PROJECT env var")
	}
	return nil
}

// maskADOToken masks a token for safe display.
// Shows only the first 4 characters to aid identification without
// revealing enough to reduce brute-force entropy.
func maskADOToken(token string) string {
	if token == "" {
		return "(not set)"
	}
	if len(token) <= 4 {

View on GitHub (pinned to 71377f2769)

Solutions

1. Run `bd config set ado.pat <token>` with a valid Azure DevOps PAT
2. Export AZURE_DEVOPS_PAT=<token> in the shell/CI environment
3. Verify with `bd config get ado.pat` (masked) that a token is actually persisted for the repo/user

Example fix

// before (CI)
- run: bd ado sync
// after
- run: bd ado sync
  env:
    AZURE_DEVOPS_PAT: ${{ secrets.ADO_PAT }}

if os.Getenv("AZURE_DEVOPS_PAT") == "" {
    if pat, _ := config.Get("ado.pat"); pat == "" {
        return errors.New("set ado.pat via bd config or AZURE_DEVOPS_PAT before running ADO commands")
    }
}

if err := bdAdoSync(); err != nil && strings.Contains(err.Error(), "ado.pat not configured") {
    return configurePATThenRetry()
}

When it happens

Trigger: Running any ADO command that calls validateADOConfig (runADOStatus, runADOSync, runADOPush, runADOPull, or the anonymous command setup) with ado.pat unset in bd config and AZURE_DEVOPS_PAT absent from the environment.

Common situations: Fresh ADO integration setup; CI runners where the secret env var was never injected; PAT stored under a different config key or exported only in an interactive shell, not the service context.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• ado.org not configured: set via 'bd config set ado.org <org>
• no ADO project configured Set via 'bd config set ado.project
• failed to list projects: %w
• failed to get work item types: %w
• Azure DevOps PAT not configured (set ado.pat or AZURE_DEVOPS

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/e79581f801ed19ea. Report an issue: GitHub.