`auth login` is not supported for this provider. Use `auth p

Error message

`auth login` is not supported for this provider. Use `auth paste-token` or `auth setup-token` for bearer-token providers.

What it means

This is the default AuthProviderImpl::login implementation, inherited by every provider that authenticates with static bearer tokens (e.g. an API-key provider) instead of OAuth. Such providers have no authorization-code or device-code flow to run, so `auth login` unconditionally bails and the message points at the supported alternatives: `auth paste-token` or `auth setup-token`.

Source

Thrown at crates/zeroclaw-providers/src/auth/mod.rs:1050

    /// No auth profile exists for this provider; caller decides whether
    /// to surface a hint to run `auth login`.
    NoProfile,
}

#[async_trait::async_trait]
pub trait AuthProviderFlow: Send + Sync {
    /// Run the OAuth login flow. The default impl bails — only providers
    /// with an OAuth login flow override. `import` is a path to an
    /// existing token-set JSON file for providers that support importing
    /// already-issued credentials (OpenAI Codex `~/.codex/auth.json`).
    async fn login(
        &self,
        _ctx: &AuthFlowContext<'_>,
        _profile: &str,
        _device_code: bool,
        _import: Option<&std::path::Path>,
    ) -> Result<()> {
        anyhow::bail!(
            "`auth login` is not supported for this provider. Use `auth paste-token` or \
             `auth setup-token` for bearer-token providers.",
        )
    }

    /// Resume an OAuth login from a paste-redirect URL/code. The default
    /// impl bails for providers that don't expose a browser flow.
    async fn paste_redirect(
        &self,
        _ctx: &AuthFlowContext<'_>,
        _profile: &str,
        _input: Option<&str>,
    ) -> Result<()> {
        anyhow::bail!(
            "`auth paste-redirect` is not supported for this provider. Only OpenAI Codex and \
             Gemini expose a browser-based OAuth flow.",
        )
    }

View on GitHub (pinned to 88bb9c8533)

Solutions

Use `zeroclaw auth paste-token --model-provider <provider>` to store the API key directly
Or use `zeroclaw auth setup-token` if the provider supports guided token setup
Check the provider's auth method in the docs/provider table before choosing the subcommand

Example fix

# before
zeroclaw auth login --model-provider my-bearer-provider --profile default

# after
zeroclaw auth paste-token --model-provider my-bearer-provider --profile default

Defensive patterns

Strategy: fallback

Try / catch

match provider.login(ctx, profile, false, None).await {
    Ok(()) => Ok(()),
    Err(e) if e.to_string().contains("paste-token") => {
        // bearer provider: fall back to token entry
        provider.paste_token(ctx, profile, token).await
    }
    Err(e) => Err(e),
}

Prevention

Check the provider's supported auth methods before scripting `auth login`
For API-key providers, always use paste-token / setup-token

When it happens

Trigger: Running `zeroclaw auth login --model-provider <bearer-provider> --profile <p>` for any provider that does not override the default login method.

Common situations: Copy-pasting the OAuth login instructions from a Codex/Gemini guide while configuring an API-key provider, or assuming all entries in `zeroclaw auth providers` support interactive login.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/679f715bc01f6b3a. Report an issue: GitHub.