langchain-ai/deepagents · error · NoAllowedModelCredentialsError

No credentials are configured for any model in models.allowe

Error message

No credentials are configured for any model in models.allowed. Add credentials for one of: {allowed}.

What it means

Raised when `models.allowed` is configured in config.toml but none of the allowlisted models have usable credentials. It is a `NoCredentialsConfiguredError` subclass so deferred-start paths still prompt for credentials, but it is distinct because only a credential for an allowlisted provider can resolve it — adding credentials for a non-allowlisted provider will not help.

Source

Thrown at libs/code/deepagents_code/config.py:5125

            # deliberately permits that state.
            if auth.state is not ProviderAuthState.MISSING:
                return candidate
        if not candidates:
            # Every entry is a wildcard for a provider with no discoverable
            # models, so there is nothing to credential.
            allowed = ", ".join(config.allowed_models)
            msg = (
                "No discoverable models match models.allowed "
                f"({allowed}). Name an exact provider:model spec or configure "
                "models for a wildcarded provider."
            )
            raise NoAllowedModelCredentialsError(msg)
        allowed = ", ".join(candidates)
        msg = (
            "No credentials are configured for any model in models.allowed. "
            f"Add credentials for one of: {allowed}."
        )
        raise NoAllowedModelCredentialsError(msg)

    # `is True` deliberately excludes `ProviderAuthState.UNKNOWN` (which maps
    # to `as_legacy_bool() -> None`). For the three explicit-credential
    # providers below, an UNKNOWN result means we cannot prove auth works, so
    # we fall through rather than pick an unverifiable default. If an
    # implicit-auth provider (e.g., Vertex ADC) is added to this fallback
    # list, switch to checking `state` against the relevant
    # `ProviderAuthState` members directly.
    if get_provider_auth_status("openai").as_legacy_bool() is True:
        return "openai:gpt-5.6-terra"
    if get_provider_auth_status("anthropic").as_legacy_bool() is True:
        return "anthropic:claude-opus-5"
    if get_provider_auth_status("google_genai").as_legacy_bool() is True:
        return "google_genai:gemini-3.1-pro-preview"

    msg = (
        "No credentials configured. Please set one of: "
        "ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_API_KEY"

View on GitHub (pinned to a1af029e6e)

Solutions

  1. Add credentials for one of the models listed in the message: run `/auth` or export the provider's key (ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, ...)
  2. Remove or widen `models.allowed` in config.toml if the policy no longer matches providers you can credential
  3. Verify the key is visible in the environment where dcode runs (`echo $ANTHROPIC_API_KEY`), not only in an unsourced shell profile

Example fix

// before (config.toml)
[models]
allowed = ["anthropic:claude-opus-5"]
# ANTHROPIC_API_KEY unset

// after
$ export ANTHROPIC_API_KEY=sk-ant-...
$ dcode   # resolves anthropic:claude-opus-5
Defensive patterns

Strategy: validation

Validate before calling

import os
from deepagents_code.model_config import ModelConfig, get_provider_auth_status, ProviderAuthState, ModelSpec

cfg = ModelConfig.load()
if cfg.allowed_models is not None:
    for entry in cfg.allowed_models:
        for spec in [entry] if ":" in entry else [entry]:
            provider = ModelSpec.parse(spec).provider
            if get_provider_auth_status(provider).state == ProviderAuthState.MISSING:
                print(f"Set credentials for {provider} before launch")

Type guard

def has_allowlisted_credentials(cfg) -> bool:
    from deepagents_code.model_config import ProviderAuthState, get_provider_auth_status, ModelSpec
    if cfg.allowed_models is None:
        return True
    return any(
        get_provider_auth_status(ModelSpec.parse(s).provider).state
        is not ProviderAuthState.MISSING
        for entry in cfg.allowed_models
        for s in ([entry] if ":" in entry else [entry])
    )

Try / catch

from deepagents_code.model_config import NoAllowedModelCredentialsError
try:
    model_spec = resolve_default_model_spec()
except NoAllowedModelCredentialsError as e:
    print(f"Configure credentials for an allowlisted provider: {e}")
    # Do NOT silently retry: only an allowlisted provider's credential resolves this.

Prevention

When it happens

Trigger: Calling the default-model resolution function when: (1) `models.allowed` is set, (2) the stored default/recent model is absent or outside the policy, and (3) `get_provider_auth_status` returns `ProviderAuthState.MISSING` for every expanded candidate from the allowlist (config.py:5100-5125).

Common situations: Setting `models.allowed = ["anthropic:*"]` but never running `/auth` or exporting ANTHROPIC_API_KEY; switching machines or CI containers without copying credentials; allowlisting a provider whose key env var is not set in the execution environment.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/ab1d19f75ced1f39. Report an issue: GitHub.