router-for-me/CLIProxyAPI · error

auth provider %s returned invalid auth data

Error message

auth provider %s returned invalid auth data

What it means

Thrown by Host.callParseAuths when h.AuthDataToCoreAuth(data, req.Path, req.FileName) returns nil for an entry returned by the plugin's ParseAuth. The converter rejects AuthData it cannot turn into a core auth (invalid required fields for the provider type), so the plugin response is treated as invalid rather than partially accepted.

Source

Thrown at internal/pluginhost/auth_provider.go:244

	}
	if !resp.Handled {
		return nil, false, nil
	}
	datas := pluginAuthParseResponseAuths(resp)
	auths = make([]*coreauth.Auth, 0, len(datas))
	for _, data := range datas {
		if strings.TrimSpace(data.Provider) == "" {
			data.Provider = req.Provider
		}
		if strings.TrimSpace(data.Provider) == "" {
			data.Provider = normalizeProviderID(provider.Identifier())
		}
		if normalizeProviderID(data.Provider) == "" {
			return nil, true, fmt.Errorf("auth provider %s returned auth without provider", record.id)
		}
		parsed := h.AuthDataToCoreAuth(data, req.Path, req.FileName)
		if parsed == nil {
			return nil, true, fmt.Errorf("auth provider %s returned invalid auth data", record.id)
		}
		auths = append(auths, parsed)
	}
	return auths, true, nil
}

func pluginAuthParseResponseAuths(resp pluginapi.AuthParseResponse) []pluginapi.AuthData {
	if len(resp.Auths) > 0 {
		return append([]pluginapi.AuthData(nil), resp.Auths...)
	}
	return []pluginapi.AuthData{resp.Auth}
}

func (h *Host) StartLogin(ctx context.Context, provider string, baseURL string) (pluginapi.AuthLoginStartResponse, bool, error) {
	record := h.authProviderRecord(provider)
	if record == nil {
		return pluginapi.AuthLoginStartResponse{}, false, nil
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Log/inspect the AuthData the plugin returned and compare with the field requirements for that provider in the host's AuthDataToCoreAuth
2. Fix the plugin to emit the complete, correctly typed AuthData for the provider
3. Align plugin and host versions so the auth schema matches

// plugin side: sanity-check entries before returning
for _, a := range auths {
    if strings.TrimSpace(a.Provider) == "" || len(a.Payload()) == 0 {
        return nil, fmt.Errorf("incomplete auth data for %s", a.Provider)
    }
}

if err != nil && strings.Contains(err.Error(), "returned invalid auth data") {
    // dump the AuthData (redacted) and fix missing/typed-wrong fields in the plugin
}

When it happens

Trigger: Plugin returns AuthData missing required fields for the declared provider (e.g. no token/credentials payload), with an unrecognized provider type, or with fields in the wrong shape, causing the converter to bail.

Common situations: Plugin emitting a provider-specific schema the host no longer recognizes after an upgrade; half-initialized AuthData structs; test stubs returning skeleton data.

Related errors

• auth provider %s returned auth without provider
• invalid auth file name
• auth file name must end with .json
• json is required
• invalid auth json: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/eeb7fed408e7bacf. Report an issue: GitHub.