What causes "unknown auth context grant type: %s" in pulumi/pulumi?

Populate `authContext.GrantType` with `workspace.AuthContextGrantTypeTokenExchange` and a valid OIDC token

unknown auth context grant type: %s

Error message

unknown auth context grant type: %s

What it means

`LoginFromAuthContext` logs into a backend using a pre-built auth context, currently supporting only the `token-exchange` (OIDC) grant type. If the auth context carries any other grant type, the function returns this error naming the unrecognized value. It's a guard against extending AuthContext with grant types the login manager does not yet implement.

Source

Thrown at pkg/cmd/pulumi/backend/login_manager.go:137

	ctx context.Context,
	sink diag.Sink,
	url string,
	project *workspace.Project,
	setCurrent bool,
	insecure bool,
	authContext workspace.AuthContext,
) (backend.Backend, error) {
	if authContext.GrantType == workspace.AuthContextGrantTypeTokenExchange {
		lm := httpstate.NewLoginManager()
		_, err := lm.LoginWithOIDCToken(
			ctx, sink, url, insecure, authContext.Token, authContext.Organization, authContext.Scope,
			authContext.Expiration, setCurrent)
		if err != nil {
			return nil, err
		}
		return httpstate.New(ctx, sink, url, project, insecure)
	}
	return nil, fmt.Errorf("unknown auth context grant type: %s", authContext.GrantType)
}

type MockLoginManager struct {
	CurrentF func(
		ctx context.Context,
		ws pkgWorkspace.Context,
		sink diag.Sink,
		url string,
		project *workspace.Project,
		setCurrent bool,
	) (backend.Backend, error)

	LoginF func(
		ctx context.Context,
		ws pkgWorkspace.Context,
		sink diag.Sink,
		url string,
		project *workspace.Project,

View on GitHub (pinned to 793f7b2e16)

Solutions

Populate `authContext.GrantType` with `workspace.AuthContextGrantTypeTokenExchange` and a valid OIDC token
If a different grant type is genuinely needed, add a handler branch in `LoginFromAuthContext` before calling it with that type
Check the caller constructing the AuthContext (e.g. PULUMI_ACCESS_TOKEN or agent credential parsing) for why the grant type is unset

Example fix

// before
authCtx := workspace.AuthContext{Token: tok}
backend, err := lm.LoginFromAuthContext(ctx, sink, url, proj, true, false, authCtx)
// unknown auth context grant type: 
// after
authCtx := workspace.AuthContext{GrantType: workspace.AuthContextGrantTypeTokenExchange, Token: tok}
backend, err := lm.LoginFromAuthContext(ctx, sink, url, proj, true, false, authCtx)

Defensive patterns

Strategy: validation

Validate before calling

// validate the grant type before calling LoginFromAuthContext
if authContext.GrantType != workspace.AuthContextGrantTypeTokenExchange {
    return fmt.Errorf("unsupported grant type %q; only token-exchange is supported", authContext.GrantType)
}

Type guard

func isTokenExchangeAuth(ac workspace.AuthContext) bool {
    return ac.GrantType == workspace.AuthContextGrantTypeTokenExchange && ac.Token != ""
}

Try / catch

b, err := lm.LoginFromAuthContext(ctx, sink, url, project, true, false, ac)
if err != nil && strings.HasPrefix(err.Error(), "unknown auth context grant type") {
    return fmt.Errorf("upgrade the CLI or use token-exchange auth: %w", err)
}

Prevention

Only construct AuthContext with workspace.AuthContextGrantTypeTokenExchange
Check the grant type constant set in the workspace package before use
Handle empty GrantType explicitly at the credential-parsing layer

When it happens

Trigger: Calling `LoginManager.LoginFromAuthContext` with a `workspace.AuthContext` whose `GrantType` is anything other than `workspace.AuthContextGrantTypeTokenExchange` (including empty string).

Common situations: Custom tooling or automation building an AuthContext programmatically with a wrong/empty GrantType; a new grant type added to workspace.AuthContext but not yet handled by the login manager; Pulumi Deployments/agent integrations passing unexpected credentials.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/eebb6f990ed15a8e. Report an issue: GitHub.