What causes "no credential providers could handle the request" in rust-lang/cargo?

Add a credential provider that handles the registry URL: set a token with `cargo login --registry ` (uses cargo:token) or configure a `credential-process` in config.toml whose provider accepts that URL.

rust-lang/cargo · error · anyhow::Error

no credential providers could handle the request

Error message

no credential providers could handle the request

What it means

Cargo iterates every configured credential provider for a registry (token, paseto, libsecret/wincred/keychain, or an external credential-process) and each one either succeeds, fails hard, or returns UrlNotSupported/NotFound. This error fires only when every provider returned UrlNotSupported for the registry URL — i.e. none of them recognized the URL as one they can handle — and none returned NotFound. It means authentication cannot proceed because no provider claims ownership of that registry's URL.

Source

Thrown at src/util/auth/mod.rs:572

        })?;
        match provider.perform(&registry, &action, &args[1..]) {
            Ok(response) => return Ok(response),
            Err(cargo_credential::Error::UrlNotSupported) => {}
            Err(cargo_credential::Error::NotFound) => any_not_found = true,
            e => {
                return e.with_context(|| {
                    format!(
                        "credential provider `{}` failed action `{action}`",
                        args.join(" ")
                    )
                });
            }
        }
    }
    if any_not_found {
        Err(cargo_credential::Error::NotFound.into())
    } else {
        anyhow::bail!("no credential providers could handle the request")
    }
}

/// Returns the token to use for the given registry.
/// If a `login_url` is provided and a token is not available, the
/// `login_url` will be included in the returned error.
pub fn auth_token(
    gctx: &GlobalContext,
    sid: &SourceId,
    login_url: Option<&Url>,
    operation: Operation<'_>,
    headers: Vec<String>,
    require_cred_provider_config: bool,
) -> CargoResult<String> {
    match auth_token_optional(gctx, sid, operation, headers, require_cred_provider_config)? {
        Some(token) => Ok(token.expose()),
        None => Err(AuthorizationError::new(
            gctx,

View on GitHub (pinned to 0e07a15537)

Solutions

Add a credential provider that handles the registry URL: set a token with `cargo login --registry <name>` (uses cargo:token) or configure a `credential-process` in config.toml whose provider accepts that URL.
Verify the registry URL in config.toml matches what the provider expects (scheme, host, path).
Run with `--verbose` to see which providers were tried and that they returned UrlNotSupported.
Check that the provider name in `global-credential-providers` is spelled correctly and that the binary is on PATH.

Example fix

// config.toml before (no provider covers the URL)
[registries.my-registry]
index = "https://private.example.com/cratesio-index"

// after
[registries.my-registry]
index = "https://private.example.com/cratesio-index"
[registry."my-registry"]
global-credential-providers = ["cargo:token"]
// then: cargo login --registry my-registry

Defensive patterns

Strategy: validation

Validate before calling

// Before triggering an authed operation, confirm at least one
// configured provider plausibly covers the registry URL.
fn registry_has_provider(gctx: &GlobalContext, sid: &SourceId) -> bool {
    let providers = cargo::util::auth::credential_provider(gctx, sid, false, true).unwrap_or_default();
    !providers.is_empty()
}
// Then: if !registry_has_provider(&gctx, &sid) { warn user / configure a provider }

Try / catch

// Match on the anyhow error and surface a configuration hint.
match cargo::ops::publish(...) {
    Ok(_) => {},
    Err(e) if e.to_string().contains("no credential providers could handle the request") => {
        eprintln!("configure a credential provider for this registry first");
    }
    Err(e) => return Err(e),
}

Prevention

Always run `cargo login --registry <name>` before publishing to a private registry.
Keep the `global-credential-providers` list in config.toml in sync with your registries.
Use `--verbose` once to confirm which providers cargo tries for each registry.

When it happens

Trigger: Calling cargo operations that need auth (publish/login/fetch a private registry) where the registry's index URL does not match any configured `credential-process` provider's URL filter, and the built-in providers (cargo:token, cargo:libsecret, etc.) all return UrlNotSupported for that URL.

Common situations: A custom/private registry is configured in config.toml under [registry] or [registries] but the `[registry.'my-registry'] global-credential-providers` list does not include a provider that covers that URL; or a credential-process binary that only handles a specific host was removed/renamed; or migrating from cargo:token to a credential-process without updating provider config.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/c331f275c6caeefc.json. Report an issue: GitHub.