google-gemini/gemini-cli · error · Error

openIdConnect auth provider not yet implemented

Error message

openIdConnect auth provider not yet implemented

What it means

A2AAuthProviderFactory.create switches on authConfig.type and explicitly rejects 'openIdConnect' because no provider is implemented yet (marked TODO). It throws synchronously inside the async factory. Any agent whose frontmatter auth.type resolves to openIdConnect cannot be authenticated until the provider ships.

Source

Thrown at packages/core/src/agents/auth-provider/factory.ts:87

      case 'oauth2': {
        // Dynamic import to avoid pulling MCPOAuthTokenStorage into the
        // factory's static module graph, which causes initialization
        // conflicts with code_assist/oauth-credential-storage.ts.
        const { OAuth2AuthProvider } = await import('./oauth2-provider.js');
        const provider = new OAuth2AuthProvider(
          authConfig,
          options.agentName ?? 'unknown',
          agentCard,
          options.agentCardUrl,
        );
        await provider.initialize();
        return provider;
      }

      case 'openIdConnect':
        // TODO: Implement
        throw new Error('openIdConnect auth provider not yet implemented');

      default: {
        const _exhaustive: never = authConfig;
        throw new Error(
          `Unknown auth type: ${(_exhaustive as A2AAuthConfig).type}`,
        );
      }
    }
  }

  /** Create provider directly from config, bypassing AgentCard validation. */
  static async createFromConfig(
    authConfig: A2AAuthConfig,
    agentName?: string,
  ): Promise<A2AAuthProvider> {
    const provider = await A2AAuthProviderFactory.create({
      authConfig,
      agentName,

View on GitHub (pinned to 5024443c72)

Solutions

1. Switch the agent to a supported auth type (oauth2, http, apiKey, or google-credentials) if the server supports it.
2. Wait for / implement the openIdConnect provider in the factory.
3. If the server offers multiple schemes, configure one that is implemented.
4. Run the agent without auth if the server permits anonymous access.

Example fix

# before
---
name: svc
kind: remote
auth:
  type: openIdConnect
---

# after (if server also supports oauth2)
---
name: svc
kind: remote
auth:
  type: oauth
  client_id: my-client
---

const supported = new Set(['google-credentials', 'apiKey', 'http', 'oauth2']);
if (!supported.has(authConfig.type)) {
  throw new Error(`Auth type '${authConfig.type}' is not supported. Use one of: ${[...supported].join(', ')}`);
}
await A2AAuthProviderFactory.create({ authConfig, agentName });

function isImplementedAuthType(
  t: string,
): t is 'google-credentials' | 'apiKey' | 'http' | 'oauth2' {
  return ['google-credentials', 'apiKey', 'http', 'oauth2'].includes(t);
}

When it happens

Trigger: An agent's frontmatter declares auth: { type: 'openIdConnect', ... }; a remote agent card exposes an openIdConnect security scheme and the loader mapped it to this config type; createFromConfig was called with an OIDC config.

Common situations: Adopting an A2A server that only advertises OIDC; testing OIDC support before the provider landed; an agent card auto-discovered from a server that uses OIDC exclusively.

Related errors

• Failed to initialize GCS bucket ${this.bucketName}: ${error}
• The enforced authentication type is '${enforcedType}', but t
• The auth type '${enforcedType}' is enforced, but no authenti
• Please set an Auth method in your ${USER_SETTINGS_PATH} or s
• Protocol "${urlObj.protocol}" is not secure. Google Credenti

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/d7210b4cdd07d77b. Report an issue: GitHub.