github/spec-kit · error · ValueError

AzureDevOpsAuth does not support auth scheme {auth_scheme!r}

Error message

AzureDevOpsAuth does not support auth scheme {auth_scheme!r}

What it means

AzureDevOpsAuth.auth_headers() maps an auth scheme to an Authorization header: 'basic-pat' becomes Basic base64(':' + token), and 'bearer'/'azure-cli'/'azure-ad' become Bearer <token>. Any other scheme string raises ValueError, because Azure DevOps has no other supported header construction in this provider.

Source

Thrown at src/specify_cli/authentication/azure_devops.py:57

    Supports four auth schemes:

    * ``basic-pat`` — PAT with empty username, Base64-encoded as ``:<PAT>``
    * ``bearer`` — pre-acquired OAuth / Azure AD token
    * ``azure-cli`` — acquires a token via ``az account get-access-token``
    * ``azure-ad`` — acquires a token via OAuth2 client credentials flow
    """

    key = "azure-devops"
    supported_auth_schemes = ("basic-pat", "bearer", "azure-cli", "azure-ad")

    def auth_headers(self, token: str, auth_scheme: str) -> dict[str, str]:
        """Build the ``Authorization`` header for the given scheme."""
        if auth_scheme == "basic-pat":
            encoded = base64.b64encode(f":{token}".encode("ascii")).decode("ascii")
            return {"Authorization": f"Basic {encoded}"}
        if auth_scheme in ("bearer", "azure-cli", "azure-ad"):
            return {"Authorization": f"Bearer {token}"}
        raise ValueError(
            f"AzureDevOpsAuth does not support auth scheme {auth_scheme!r}"
        )

    def resolve_token(self, entry: AuthConfigEntry) -> str | None:
        """Resolve token, with special handling for azure-cli and azure-ad."""
        if entry.auth == "azure-cli":
            return self._acquire_via_az_cli()
        if entry.auth == "azure-ad":
            return self._acquire_via_client_credentials(entry)
        return super().resolve_token(entry)

    # -- Token acquisition ------------------------------------------------

    @staticmethod
    def _acquire_via_az_cli() -> str | None:
        """Run ``az account get-access-token`` and return the access token."""
        try:
            # Windows: ``subprocess.run`` calls ``CreateProcess``, which does

View on GitHub (pinned to bf88c9f9a8)

Solutions

1. Set "auth" in the azure-devops provider entry to one of: "basic-pat", "bearer", "azure-cli", "azure-ad" (exact lowercase).
2. For a classic Azure DevOps PAT used against the REST API, "basic-pat" is the standard choice.
3. For Entra ID scenarios use "azure-cli" (az cli acquisition) or "azure-ad" (client credentials) instead of inventing a scheme.
4. Upgrade specify-cli if you need a scheme added in a newer release.

Example fix

# before (auth.json)
{"providers": [{"hosts": ["dev.azure.com"], "provider": "azure-devops", "auth": "pat", "token": "..."}]}
# after
{"providers": [{"hosts": ["dev.azure.com"], "provider": "azure-devops", "auth": "basic-pat", "token": "..."}]}

SUPPORTED = {"basic-pat", "bearer", "azure-cli", "azure-ad"}

if entry.auth not in SUPPORTED:
    raise SystemExit(
        f"unsupported azure-devops auth {entry.auth!r}; use one of {sorted(SUPPORTED)}"
    )

from typing import Any

SUPPORTED = {"basic-pat", "bearer", "azure-cli", "azure-ad"}

def is_supported_ado_scheme(scheme: Any) -> bool:
    """True when scheme is an exact, supported Azure DevOps auth scheme."""
    return scheme in SUPPORTED

try:
    headers = auth.auth_headers(token, entry.auth)
except ValueError as exc:
    if "does not support auth scheme" in str(exc):
        raise SystemExit(f"fix auth.json: {exc}") from exc
    raise

When it happens

Trigger: auth.json entry with "auth": "pat", "npat", "Basic-PAT" (case-sensitive), or "token" for an azure-devops provider; a config value copied from a different tool's scheme names; passing auth_scheme programmatically with a typo.

Common situations: Migrating from gh/git credential configs whose scheme vocabulary differs; uppercase variants assumed to be normalized; new Azure schemes (e.g. workload identity) not yet supported by the installed version.

Related errors

• auth.json must be a JSON object, got {type(raw).__name__}
• auth.json must contain a 'providers' array
• providers[{i}]: must be a JSON object
• providers[{i}]: 'hosts' must be a non-empty array
• providers[{i}]: each host must be a non-empty string

AI-assisted analysis of github/spec-kit@bf88c9f9a8 (2026-08-14). Data as JSON: /api/errors/a577f34d26af3298. Report an issue: GitHub.