What causes "secret provider %q has source %q but ref requests %q" in larksuite/cli?

Make the ref's source match the provider's configured source

secret provider %q has source %q but ref requests %q

Error message

secret provider %q has source %q but ref requests %q

What it means

LookupProvider compares the provider's configured Source with the Source in the secret ref; a mismatch means the named provider cannot serve this ref kind (e.g. an env provider asked for a file ref). This prevents silently resolving a secret through the wrong backend.

Source

Thrown at internal/binding/types.go:213

			}
		}
	}
	return DefaultProviderAlias
}

// LookupProvider resolves a provider config from the registry.
// Returns the provider config or an error if not found.
// Special case: env source with "default" provider returns a synthetic empty env provider.
func LookupProvider(ref *SecretRef, cfg *SecretsConfig) (*ProviderConfig, error) {
	providerName := ResolveDefaultProvider(ref, cfg)

	if cfg != nil && cfg.Providers != nil {
		if pc, ok := cfg.Providers[providerName]; ok {
			if pc == nil {
				return nil, fmt.Errorf("secret provider %q is configured as null", providerName)
			}
			if pc.Source != ref.Source {
				return nil, fmt.Errorf("secret provider %q has source %q but ref requests %q",
					providerName, pc.Source, ref.Source)
			}
			return pc, nil
		}
	}

	// Special case: default env provider (implicit, per OpenClaw resolve.ts)
	if ref.Source == "env" && providerName == DefaultProviderAlias {
		return &ProviderConfig{Source: "env"}, nil
	}

	return nil, fmt.Errorf("secret provider %q is not configured (ref: %s:%s:%s)",
		providerName, ref.Source, providerName, ref.ID)
}

// CandidateApp represents a bindable app from OpenClaw's feishu channel config.
type CandidateApp struct {
	Label     string

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Make the ref's source match the provider's configured source
Configure a provider with the ref's source and reference it by name
Drop the explicit `provider` field so the implicit default (or an explicit one) is used consistently

Example fix

// before
{"source": "file", "id": "token", "provider": "default"} // default has source env
// after
{"source": "env", "id": "TOKEN"}

Defensive patterns

Strategy: validation

Validate before calling

for _, ref := range refs {
    p, ok := cfg.Secrets.Providers[ref.Provider]
    if ok && p.Source != ref.Source {
        return fmt.Errorf("ref %s:%s uses provider %q with source %q", ref.Source, ref.ID, ref.Provider, p.Source)
    }
}

Prevention

Remember `provider` names a backend; it never overrides `source`
Name providers by their source (e.g. env-default, exec-vault) to prevent mismatches
Cross-check refs against provider sources in a lint script

When it happens

Trigger: A ref like {"source":"file","id":"token","provider":"default"} where provider "default" is configured with source "env".

Common situations: Reusing one provider name across refs of different sources after refactoring; renaming sources in config without updating refs; misunderstanding that `provider` does not override `source`.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/1fc6dbc33ea5e882. Report an issue: GitHub.