google-gemini/gemini-cli · error · Error

Failed to create auth provider for agent '${definition.name}

Error message

Failed to create auth provider for agent '${definition.name}'

What it means

Thrown in AgentRegistry remote-agent registration when definition.auth is set but A2AAuthProviderFactory.create() returned undefined. The factory returns undefined only when authConfig is absent/empty or when the agent card exposes security schemes that are not covered by config — so this guard fires when the auth block is truthy yet produces no provider (e.g. empty object, or a type the factory silently skips).

Source

Thrown at packages/core/src/agents/registry.ts:510

    try {
      const clientManager = this.config.getA2AClientManager();
      if (!clientManager) {
        debugLogger.warn(
          `[AgentRegistry] Skipping remote agent '${definition.name}': A2AClientManager is not available.`,
        );
        return;
      }
      const targetUrl = getRemoteAgentTargetUrl(remoteDef);
      let authHandler: AuthenticationHandler | undefined;
      if (definition.auth) {
        const provider = await A2AAuthProviderFactory.create({
          authConfig: definition.auth,
          agentName: definition.name,
          targetUrl,
          agentCardUrl: remoteDef.agentCardUrl,
        });
        if (!provider) {
          throw new Error(
            `Failed to create auth provider for agent '${definition.name}'`,
          );
        }
        authHandler = provider;
      }

      const agentCard = await clientManager.loadAgent(
        remoteDef.name,
        getAgentCardLoadOptions(remoteDef),
        authHandler,
      );

      // Validate auth configuration against the agent card's security schemes.
      if (agentCard.securitySchemes) {
        const validation = A2AAuthProviderFactory.validateAuthConfig(
          definition.auth,
          agentCard.securitySchemes,
        );

View on GitHub (pinned to 5024443c72)

Solutions

1. Populate definition.auth fully — at minimum a recognized `type` ('google-credentials' | 'apiKey' | 'http' | 'oauth2').
2. Ensure the auth type is one the factory supports (note 'openIdConnect' throws 'not yet implemented' rather than returning undefined).
3. Remove the auth block entirely if the remote agent does not require authentication.
4. Inspect agentCard.securitySchemes and supply matching config fields.

Example fix

// before
auth: { }   // truthy but no type -> factory returns undefined

// after
auth: { type: 'apiKey', apiKey: '$MY_API_KEY', location: 'header', name: 'X-API-Key' }

const SUPPORTED = new Set(['google-credentials','apiKey','http','oauth2']);
function assertAuth(auth) {
  if (auth && !SUPPORTED.has(auth.type))
    throw new Error(`Unsupported auth type: ${auth?.type}`);
  if (auth && !auth.type)
    throw new Error('auth.type is required');
}

function hasSupportedAuthType(a) {
  return !!a && typeof a.type === 'string' &&
    ['google-credentials','apiKey','http','oauth2'].includes(a.type);
}

try {
  await registerRemoteAgent(def);
} catch (e) {
  if (e instanceof Error && /Failed to create auth provider/.test(e.message)) {
    // fix def.auth.type / fields, then re-register
  }
  throw e;
}

When it happens

Trigger: registerRemoteAgent with definition.auth truthy (e.g. auth: {} or an object the factory does not turn into a provider); factory.create({...definition.auth}) returns undefined because authConfig resolved to undefined/empty after destructuring, or the agent card has security schemes and config is insufficient.

Common situations: auth: {} placeholder in the agent config; auth object present but its `type` field missing or empty so the factory treats it as no-config; security scheme mismatch where the factory declines to build.

Related errors

• Failed to create auth provider for agent '${definition.name}
• Remote agent '${definition.name}' requires a string 'query'
• Failed to initialize RemoteAgentInvocation for '${definition
• Remote agent '${definition.name}' requires a string 'query'
• The enforced authentication type is '${enforcedType}', but t

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/cd6b64f6a2f96e9b. Report an issue: GitHub.