github/spec-kit · error · ValueError

providers[{i}]: provider {provider!r} does not support auth

Error message

providers[{i}]: provider {provider!r} does not support auth scheme {auth!r}; supported: {list(_prov.supported_auth_schemes)}

What it means

Raised when the provider resolved from `AUTH_REGISTRY` does not list the configured `auth` scheme among its `supported_auth_schemes`. The message enumerates the schemes that particular provider actually supports so you can correct the combination.

Source

Thrown at src/specify_cli/authentication/config.py:172

        token_env = entry_raw.get("token_env")

        # Validate token/token_env types
        if token is not None and (not isinstance(token, str) or not token.strip()):
            raise ValueError(f"providers[{i}]: 'token' must be a non-empty string")
        if token_env is not None and (not isinstance(token_env, str) or not token_env.strip()):
            raise ValueError(f"providers[{i}]: 'token_env' must be a non-empty string")

        # Validate provider+scheme compatibility
        from . import get_provider as _get_provider
        _prov = _get_provider(provider)
        if _prov is None:
            from . import AUTH_REGISTRY
            raise ValueError(
                f"providers[{i}]: unknown provider {provider!r}; "
                f"registered: {sorted(AUTH_REGISTRY.keys())}"
            )
        if auth not in _prov.supported_auth_schemes:
            raise ValueError(
                f"providers[{i}]: provider {provider!r} does not support "
                f"auth scheme {auth!r}; supported: {list(_prov.supported_auth_schemes)}"
            )

        # Validate token source based on auth scheme
        if auth in ("bearer", "basic-pat"):
            if not token and not token_env:
                raise ValueError(
                    f"providers[{i}]: auth={auth!r} requires 'token' or 'token_env'"
                )
        elif auth == "azure-ad":
            tenant_id = entry_raw.get("tenant_id")
            client_id = entry_raw.get("client_id")
            client_secret_env = entry_raw.get("client_secret_env")
            if not all([tenant_id, client_id, client_secret_env]):
                raise ValueError(
                    f"providers[{i}]: auth='azure-ad' requires "
                    "'tenant_id', 'client_id', and 'client_secret_env'"

View on GitHub (pinned to bf88c9f9a8)

Solutions

1. Use one of the schemes listed in the error's `supported: [...]` for that provider
2. If you need a different scheme, switch to a provider that supports it
3. Re-check the docs/examples for your specific provider version

Example fix

# before
- hosts: ["github.com"]
  provider: github
  auth: azure-ad

# after
- hosts: ["github.com"]
  provider: github
  auth: bearer

from specify_cli.authentication import get_provider

prov = get_provider(entry["provider"])
if entry["auth"] not in prov.supported_auth_schemes:
    raise SystemExit(
        f"{entry['provider']!r} supports {list(prov.supported_auth_schemes)}, "
        f"not {entry['auth']!r}"
    )

def scheme_supported(provider: str, auth: str) -> bool:
    prov = get_provider(provider)
    return prov is not None and auth in prov.supported_auth_schemes

try:
    load_auth_config(raw)
except ValueError as exc:
    if "does not support auth scheme" in str(exc):
        # read 'supported: [...]' from the message and switch scheme/provider
        raise
    raise

When it happens

Trigger: Pairing a provider with a scheme it does not implement — e.g. `provider: github` with `auth: azure-ad`, or an Azure provider with `auth: basic-pat` when it only supports `azure-ad`/`bearer`.

Common situations: Copy-pasting an example entry for a different provider and only changing the `provider` field; assuming all providers support `bearer`; upgrading spec-kit changed a provider's supported scheme set.

Related errors

• providers[{i}]: invalid host pattern {h!r}. Only exact hostn
• providers[{i}]: 'provider' must be a non-empty string
• providers[{i}]: 'auth' must be a non-empty string
• providers[{i}]: 'token' must be a non-empty string
• providers[{i}]: 'token_env' must be a non-empty string

AI-assisted analysis of github/spec-kit@bf88c9f9a8 (2026-08-14). Data as JSON: /api/errors/3e1de1a8d10b0927. Report an issue: GitHub.