vercel/ai · error · InvalidArgumentError

Both apiKey and authToken were provided. Please use only one

Error message

Both apiKey and authToken were provided. Please use only one authentication method.

What it means

createAnthropic throws InvalidArgumentError when both `apiKey` and `authToken` are present in the options object. The Anthropic provider supports two mutually exclusive authentication methods: an API key (sent as x-api-key) and an OAuth bearer token (sent as Authorization: Bearer). Providing both is ambiguous, so the provider fails fast at construction time rather than guessing which credential to use.

Source

Thrown at packages/anthropic/src/anthropic-provider.ts:130

/**
 * Create an Anthropic provider instance.
 */
export function createAnthropic(
  options: AnthropicProviderSettings = {},
): AnthropicProvider {
  const baseURL =
    normalizeBaseURL(
      loadOptionalSetting({
        settingValue: options.baseURL,
        environmentVariableName: 'ANTHROPIC_BASE_URL',
      }),
    ) ?? ANTHROPIC_API_VERSIONED_URL;

  const providerName = options.name ?? 'anthropic.messages';

  // Only error if both are explicitly provided in options
  if (options.apiKey && options.authToken) {
    throw new InvalidArgumentError({
      argument: 'apiKey/authToken',
      message:
        'Both apiKey and authToken were provided. Please use only one authentication method.',
    });
  }

  const getHeaders = () => {
    const authHeaders: Record<string, string> = options.authToken
      ? { Authorization: `Bearer ${options.authToken}` }
      : {
          'x-api-key': loadApiKey({
            apiKey: options.apiKey,
            environmentVariableName: 'ANTHROPIC_API_KEY',
            description: 'Anthropic',
          }),
        };

    return withUserAgentSuffix(

View on GitHub (pinned to 69428b1f8b)

Solutions

Remove one of the two fields: keep `apiKey` for standard API-key auth or `authToken` for OAuth/token-based auth, not both.
Conditionally build the options object so only the available credential is passed (e.g. authToken ? { authToken } : { apiKey }).
Check environment variables for stray ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN values that get merged into options.

Example fix

// before
const anthropic = createAnthropic({
  apiKey: process.env.ANTHROPIC_API_KEY,
  authToken: oauthToken,
});
// after
const anthropic = createAnthropic(
  oauthToken
    ? { authToken: oauthToken }
    : { apiKey: process.env.ANTHROPIC_API_KEY! },
);

Defensive patterns

Strategy: validation

Validate before calling

const opts = buildAnthropicOptions();
if (opts.apiKey && opts.authToken) {
  throw new Error('Provide either apiKey or authToken, not both');
}
const anthropic = createAnthropic(opts);

Try / catch

try {
  const anthropic = createAnthropic(options);
} catch (error) {
  if (InvalidArgumentError.isInstance(error)) {
    console.error('Anthropic auth config invalid:', error.message);
  }
  throw error;
}

Prevention

Build provider options from a single credential source with an explicit precedence (token over key).
Assert exactly one of apiKey/authToken is set in config load tests.
Avoid blind object spreading when merging env and secret-manager values.

When it happens

Trigger: Calling createAnthropic({ apiKey: '...', authToken: '...' }) with both fields set explicitly in the options object, e.g. merging env vars and an OAuth token config without clearing the unused one.

Common situations: Config objects built by spreading multiple sources (env, secrets manager, per-request auth) where a previous apiKey lingers; migrating from API-key auth to OAuth tokens without removing the old key; shared provider factories that always pass both fields.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/dc58b26442294305. Report an issue: GitHub.