mastra-ai/mastra · error · HTTPException

Tool provider ${providerId} does not support authorize

Error message

Tool provider ${providerId} does not support authorize

What it means

HTTP 400 thrown by the /authorize handler when the resolved provider does not implement the optional authorize method. OAuth-style authorization is opt-in for ToolProviders, so providers without it cannot start connection flows.

Source

Thrown at packages/server/src/server/handlers/tool-providers.ts:276

 * a `tool_provider_connections` row for label / scope joins.
 */
export const AUTHORIZE_TOOL_PROVIDER_ROUTE = createRoute({
  method: 'POST',
  path: '/tool-providers/:providerId/authorize',
  responseType: 'json',
  pathParamSchema: toolProviderIdPathParams,
  bodySchema: authorizeToolProviderBodySchema,
  responseSchema: authorizeToolProviderResponseSchema,
  summary: 'Authorize tool provider connection',
  description: 'Starts an OAuth flow and returns a redirect URL + opaque auth handle',
  tags: ['Tool Providers'],
  requiresAuth: true,
  handler: async ({ mastra, providerId, toolkit, connectionId, toolName, config, label, scope, requestContext }) => {
    try {
      const editor = requireEditor(mastra.getEditor());
      const provider = await resolveProvider(editor, providerId);
      if (!provider.authorize) {
        throw new HTTPException(400, { message: `Tool provider ${providerId} does not support authorize` });
      }
      // Per-pin scope:
      // - 'shared' buckets under SHARED_BUCKET_ID.
      // - 'caller-supplied' buckets under request-context resourceId (400 if missing).
      // - 'per-author' (default) buckets under the caller's resolved authorId.
      //
      // Precedence: an explicit request `scope` wins, then the provider's
      // config-level `defaultScope` (the app author's tenancy decision), then
      // `'per-author'`. This lets a provider constructed with
      // `defaultScope: 'caller-supplied'` produce per-tenant connections even
      // though no UI control selects a scope.
      const requestedScope = scope ?? provider.defaultScope;
      const effectiveScope: 'shared' | 'per-author' | 'caller-supplied' =
        requestedScope === 'shared' || requestedScope === 'caller-supplied' ? requestedScope : 'per-author';
      const callerResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY);
      if (effectiveScope === 'caller-supplied') {
        if (typeof callerResourceId !== 'string' || callerResourceId.length === 0) {
          throw new HTTPException(400, {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Implement authorize(...) on the ToolProvider and re-register it.
2. Use a provider that supports OAuth authorization for interactive connection flows.
3. Configure credentials statically if the provider only supports non-OAuth auth.
4. Upgrade the provider package to a version implementing authorize.

Example fix

// before
class MyProvider implements ToolProvider { /* no authorize */ }
// after
class MyProvider implements ToolProvider {
  async authorize({ connectionId, request }) {
    return { authorizationUrl: this.oauth.buildAuthUrl(connectionId) };
  }
}

const provider = await api.getProvider(providerId);
if (typeof provider?.authorize !== 'function') {
  console.warn(`Provider ${providerId} does not support OAuth authorize`);
}

function supportsAuthorize(p: ToolProvider): p is ToolProvider & Required<Pick<ToolProvider, 'authorize'>> {
  return typeof p.authorize === 'function';
}

try {
  return await api.authorize({ providerId, ... });
} catch (e) {
  if (e.status === 400 && /does not support authorize/.test(e.message)) {
    // fall back to static credential configuration
  } else throw e;
}

When it happens

Trigger: POST /api/tool-providers/:providerId/authorize (tool-providers.ts:276) against a provider registered without an authorize implementation.

Common situations: Trying OAuth connect on a provider that uses static API keys instead of OAuth; a custom provider implemented before authorize was added to the interface; provider package version too old to support authorization.

Related errors

• Tool provider ${providerId} does not support getAuthStatus
• Tool provider ${providerId} does not support getConnectionSt
• Tool provider ${providerId} does not support listConnections
• Tool provider ${providerId} does not support getToolSchema
• Cannot authorize caller-supplied connection: request context

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/515c25407f95b02d. Report an issue: GitHub.