mastra-ai/mastra · error · ProviderAuthRequiredError

Not logged in to GitHub Copilot.

Error message

Not logged in to GitHub Copilot.

What it means

The GitHub Copilot OAuth fetch wrapper requires a stored credential of type 'oauth' for the copilot provider. If auth storage contains no credential or a non-OAuth credential, ProviderAuthRequiredError('Not logged in to GitHub Copilot.') is thrown before any token refresh or network request. It means the user has not completed the Copilot device-flow login.

Source

Thrown at mastracode/sdk/src/providers/github-copilot.ts:127

}

/**
 * Build a fetch wrapper that authenticates with GitHub Copilot OAuth.
 *
 * - Injects the short-lived Copilot bearer token (auto-refreshed by AuthStorage).
 * - Adds the VS Code-like Copilot headers required by the API.
 * - Rewrites the request URL onto the per-token API base when `rewriteUrl` is true.
 */
export function buildGitHubCopilotOAuthFetch(
  opts: { authStorage?: CredentialStore; rewriteUrl?: boolean } = {},
): typeof fetch {
  return (async (url: string | URL | Request, init?: Parameters<typeof fetch>[1]) => {
    const storage = opts.authStorage ?? getAuthStorage();
    storage.reload();

    const cred = storage.get(COPILOT_PROVIDER_ID);
    if (!cred || cred.type !== 'oauth') {
      throw new ProviderAuthRequiredError('Not logged in to GitHub Copilot.');
    }

    // getApiKey() refreshes the Copilot bearer if it has expired.
    const accessToken = await storage.getApiKey(COPILOT_PROVIDER_ID);
    if (!accessToken) {
      throw new ProviderAuthRequiredError('Failed to refresh the GitHub Copilot token.');
    }
    storage.reload();

    const enterpriseUrl = (cred as GitHubCopilotCredentials).enterpriseUrl;

    let parsedBody: unknown;
    if (typeof init?.body === 'string') {
      try {
        parsedBody = JSON.parse(init.body);
      } catch {
        parsedBody = undefined;
      }

View on GitHub (pinned to 75dd419e61)

Solutions

1. Run the GitHub Copilot OAuth/device-flow login and ensure the credential is stored under COPILOT_PROVIDER_ID
2. Verify storage contents after login (`storage.get('github-copilot')` should be type 'oauth')
3. Catch ProviderAuthRequiredError and trigger the interactive login before retrying
4. In CI, provision the credential file or inject auth storage from a secret

Example fix

// before
const provider = copilot(); // throws if no oauth cred
// after
const cred = storage.get('github-copilot');
if (!cred || cred.type !== 'oauth') {
  await copilotDeviceFlowLogin(); // stores oauth credential
}
const provider = copilot();

storage.reload();
const cred = storage.get('github-copilot');
if (!cred || cred.type !== 'oauth') {
  throw new Error('GitHub Copilot OAuth login required (run the device-flow login).');
}

function isCopilotOAuthCred(c: unknown): c is { type: 'oauth'; enterpriseUrl?: string } {
  return typeof c === 'object' && c !== null && (c as { type?: string }).type === 'oauth';
}

try {
  await runWithCopilot();
} catch (err) {
  if (err instanceof ProviderAuthRequiredError && err.message.includes('Not logged in')) {
    await copilotDeviceFlowLogin();
  } else throw err;
}

When it happens

Trigger: Using `copilot` or `fetchWithOAuth` for GitHub Copilot when `storage.get(COPILOT_PROVIDER_ID)` returns undefined, or returns a credential whose type is not 'oauth' (e.g. an api_key entry or a legacy/stale record).

Common situations: Never completed the GitHub Copilot device-code login on this machine; auth storage cleared or relocated (different HOME in CI); GitHub Copilot subscription absent so login flow failed silently; mixing provider ids so the credential is stored under a different key.

Related errors

• No Copilot bearer token
• State token has expired
• Redirect URI is required for SSO login
• Token exchange failed: ${error}
• Failed to fetch user info from Clerk

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/b9ef9547b3882f87. Report an issue: GitHub.