google-gemini/gemini-cli · error · Error

Failed to create auth provider for agent '${definition.name}

Error message

Failed to create auth provider for agent '${definition.name}'

What it means

Thrown by RemoteAgentInvocation.getAuthHandler() when this.definition.auth is set but A2AAuthProviderFactory.create() returned undefined. Same root cause as the registry guard (error 213), but reached lazily at first call to getAuthHandler() during execute().

Source

Thrown at packages/core/src/agents/remote-invocation.ts:106

  getDescription(): string {
    return `Calling remote agent ${this.definition.displayName ?? this.definition.name}`;
  }

  private async getAuthHandler(): Promise<AuthenticationHandler | undefined> {
    if (this.authHandler) {
      return this.authHandler;
    }

    if (this.definition.auth) {
      const targetUrl = getRemoteAgentTargetUrl(this.definition);
      const provider = await A2AAuthProviderFactory.create({
        authConfig: this.definition.auth,
        agentName: this.definition.name,
        targetUrl,
        agentCardUrl: this.definition.agentCardUrl,
      });
      if (!provider) {
        throw new Error(
          `Failed to create auth provider for agent '${this.definition.name}'`,
        );
      }
      this.authHandler = provider;
    }

    return this.authHandler;
  }

  protected override async getConfirmationDetails(
    _abortSignal: AbortSignal,
  ): Promise<ToolCallConfirmationDetails | false> {
    // For now, always require confirmation for remote agents until we have a policy system for them.
    return {
      type: 'info',
      title: `Call Remote Agent: ${this.definition.displayName ?? this.definition.name}`,
      prompt: `Calling remote agent: "${this.params.query}"`,
      onConfirm: async (_outcome: ToolConfirmationOutcome) => {

View on GitHub (pinned to 5024443c72)

Solutions

1. Fully populate definition.auth with a supported `type` and required fields.
2. Validate auth config against the agent card's securitySchemes (A2AAuthProviderFactory.validateAuthConfig) before invocation.
3. Omit auth if the remote agent does not require it.
4. Cache the provider at registration (registry.ts path) to fail fast rather than at execute time.

Example fix

// before
auth: { }  // factory returns undefined at execute()

// after
auth: { type: 'http', scheme: 'bearer', token: '$MY_TOKEN' }

const SUPPORTED = new Set(['google-credentials','apiKey','http','oauth2']);
function assertInvocationAuth(auth) {
  if (auth && (!auth.type || !SUPPORTED.has(auth.type)))
    throw new Error('Auth provider cannot be created: missing/unsupported type');
}

function isCreatableAuth(a) {
  return !!a && typeof a.type === 'string' &&
    ['google-credentials','apiKey','http','oauth2'].includes(a.type);
}

try {
  await invocation.execute(opts);
} catch (e) {
  if (e instanceof Error && /Failed to create auth provider/.test(e.message)) {
    // fix auth config and retry once
  }
  throw e;
}

When it happens

Trigger: execute() -> getAuthHandler() -> A2AAuthProviderFactory.create({ authConfig: definition.auth, ... }) returns undefined. Happens when auth is truthy but yields no provider (empty/incomplete auth block, or the factory declines because agent-card security schemes are unmatched).

Common situations: auth: {} or auth without a recognized type; agent card requires a security scheme not satisfied by the provided config; the factory silently returns undefined for unsupported scheme shapes.

Related errors

• Failed to create auth provider for agent '${definition.name}
• Remote agent '${definition.name}' requires a string 'query'
• Failed to initialize RemoteAgentInvocation for '${definition
• Remote agent '${definition.name}' requires a string 'query'
• The enforced authentication type is '${enforcedType}', but t

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/be829d0e0161ea1f. Report an issue: GitHub.