The enforced authentication type is '${enforcedType}', but t

Error message

The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.

What it means

Thrown during non-interactive auth validation when `settings.merged.security.auth.enforcedType` is set (an org/policy lockdown to one auth method) but the effective auth type resolved from config or env vars differs. The effective type is the user's currently configured credential; the enforced type is the mandatory one. Mismatch is fatal in headless mode because silently picking a different auth path would bypass policy.

Source

Thrown at packages/cli/src/validateNonInterActiveAuth.ts:34

import { validateAuthMethod } from './config/auth.js';
import { handleError } from './utils/errors.js';
import { runExitCleanup } from './utils/cleanup.js';

export async function validateNonInteractiveAuth(
  configuredAuthType: AuthType | undefined,
  useExternalAuth: boolean | undefined,
  nonInteractiveConfig: Config,
  settings: LoadedSettings,
) {
  try {
    const effectiveAuthType = configuredAuthType || getAuthTypeFromEnv();

    const enforcedType = settings.merged.security.auth.enforcedType;
    if (enforcedType && effectiveAuthType !== enforcedType) {
      const message = effectiveAuthType
        ? `The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.`
        : `The auth type '${enforcedType}' is enforced, but no authentication is configured.`;
      throw new Error(message);
    }

    if (!effectiveAuthType) {
      const message = `Please set an Auth method in your ${USER_SETTINGS_PATH} or specify one of the following environment variables before running: GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA`;
      throw new Error(message);
    }

    const authType: AuthType = effectiveAuthType;

    if (!useExternalAuth) {
      const err = await validateAuthMethod(String(authType));
      if (err != null) {
        throw new Error(err);
      }
    }

    return authType;
  } catch (error) {

View on GitHub (pinned to 5024443c72)

Solutions

Re-authenticate using the method named in `enforcedType` (e.g. run the interactive login for `oauth-personal`).
Remove or correct the environment variable that is selecting the wrong auth type (`GEMINI_API_KEY`, `GOOGLE_GENAI_USE_VERTEXAI`, etc.).
If the enforcement itself is wrong, update `security.auth.enforcedType` in the merged settings source (user or project settings file) to the intended type.
Confirm which settings file is contributing `enforcedType` — the value comes from `settings.merged`, so a project-level file can override your user-level config.

Example fix

# before — settings.json
{ "security": { "auth": { "enforcedType": "oauth-personal" } } }
# but env has GEMINI_API_KEY set

# after — clear the conflicting env var and log in
$ unset GEMINI_API_KEY
$ gemini  # interactive oauth-personal login

Defensive patterns

Strategy: validation

Validate before calling

function assertAuthMatchesEnforced(
  enforcedType: string | undefined,
  effectiveType: string | undefined,
) {
  if (enforcedType && effectiveType && enforcedType !== effectiveType) {
    throw new Error(
      `Auth mismatch: enforced=${enforcedType}, effective=${effectiveType}. Re-authenticate as ${enforcedType}.`,
    );
  }
}

const enforced = settings.merged.security.auth.enforcedType;
const effective = configuredAuthType ?? getAuthTypeFromEnv();
assertAuthMatchesEnforced(enforced, effective);

Type guard

function isAuthCompatible(
  enforced: string | undefined,
  effective: string | undefined,
): boolean {
  return !enforced || !effective || enforced === effective;
}

Try / catch

try {
  await validateNonInteractiveAuth(configuredAuthType, useExternalAuth, cfg, settings);
} catch (e) {
  if (e instanceof Error && e.message.includes('enforced authentication type')) {
    // prompt re-login with enforcedType, or surface to operator
  }
  throw e;
}

Prevention

Centralize auth selection in one config layer so env and settings never disagree.
In policy-driven orgs, document the enforcedType alongside the provisioning steps for that type.
Add a startup preflight that fails fast with a friendly message before the heavy CLI boots.

When it happens

Trigger: Calling `validateNonInteractiveAuth` (or starting the CLI headlessly) with `security.auth.enforcedType` set to e.g. `oauth-personal` while the environment carries `GEMINI_API_KEY` (which resolves to `gemini-api-key`), or with `GOOGLE_GENAI_USE_VERTEXAI=true` while enforcement demands `cloud-login`. `effectiveAuthType` is non-empty but unequal to `enforcedType`.

Common situations: A team policy file pins `enforcedType: oauth-personal` but a developer has `GEMINI_API_KEY` exported in their shell; migrating from API-key auth to Vertex AI without updating the enforcement setting; an enterprise settings merge layer enforces a type that conflicts with the local `.env`.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/27df7cb28a380e64. Report an issue: GitHub.