windmill-labs/windmill · warning

Unexpected oauths value type: ${typeof s.value}

Error message

Unexpected oauths value type: ${typeof s.value}

What it means

processInstanceSettings encrypts/decrypts sensitive fields when syncing instance settings. For the `oauths` setting it expects s.value to be an object mapping oauth client names to {secret: ...} objects. If the value is not an object (null, string, array, etc.), it skips encryption for that setting and logs this warning, pushing the setting through unprocessed. The `oauths` check uses typeof === "object" which does not guard against null, so a null value in YAML is the classic hit.

Source

Thrown at cli/src/core/settings.ts:543

): Promise<GlobalSetting[]> {
  const encKey = process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
  if (encKey) {
    const res: GlobalSetting[] = [];

    for (const s of settings) {
      if (SENSITIVE_FIELD.includes(s.name) && typeof s.value === "string") {
        res.push(
          (await processField(s, "value", encKey, mode)) as GlobalSetting
        );
      } else if (s.name == "oauths") {
        if (typeof s.value === "object") {
          const oauths = s.value as { [key: string]: any };
          for (const [k, v] of Object.entries(oauths)) {
            oauths[k] = await processField(v, "secret", encKey, mode);
          }
          res.push(s);
        } else {
          log.warn(`Unexpected oauths value type: ${typeof s.value}`);
          res.push(s);
        }
      } else {
        res.push(s);
      }
    }
    return res;
  } else {
    log.warn(
      "No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY"
    );
  }
  return settings;
}

async function processField(
  obj: { [key: string]: any },
  field: string,

View on GitHub (pinned to e474e8803c)

Solutions

1. Open instance_settings.yaml and make the oauths value a mapping of client name to {secret: ...}, e.g. `oauths:\n google:\n secret: <value>`.
2. Replace a bare `oauths:` (null) with either a proper mapping or remove the setting entirely to sync nothing.
3. Re-run `wmill settings pull` to regenerate the file in the correct shape from the remote.
4. Re-pull if the file came from another instance/format conversion that flattened oauths.

Example fix

// before (broken YAML)
oauths:

// after
oauths:
  google:
    client_id: my-id
    secret: my-secret

const settings = yaml.parse(readFileSync("instance_settings.yaml", "utf8")) as GlobalSetting[];
const oauths = settings.find((s) => s.name === "oauths");
if (oauths && (oauths.value === null || typeof oauths.value !== "object")) {
  throw new Error("oauths must be a mapping of client name to {secret: ...}");
}

function isOAuthsValue(v: unknown): v is Record<string, { secret: string }> {
  return typeof v === "object" && v !== null && !Array.isArray(v) && Object.values(v).every((c) => typeof c === "object" && c !== null);
}

if (oauthsSetting && !isOAuthsValue(oauthsSetting.value)) {
  log.warn("skipping oauths: expected mapping of client -> {secret}");
}

When it happens

Trigger: Calling processInstanceSettings (via processedSettings, pullInstanceSettings, or pushInstanceSettings) when the `oauths` setting's value is not a plain object — typically a null, a string, or an array in instance_settings.yaml.

Common situations: Hand-editing instance_settings.yaml and setting `oauths:` with no value (YAML null); a partial copy of settings between instances; a tool that stringified the oauths block; pulling from an instance where oauths was never configured and serializing oddly.

Related errors

• wmill-lock.yaml is malformed (expected an object). Refusing
• Error parsing yaml ${path}
• Vault Password File expects a String containing the file nam
• Vault ID field expects an array of strings in the format: `l
• The elements of the vault_id field should be strings in the

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/c10f058cf8911ee4. Report an issue: GitHub.