zeroclaw-labs/zeroclaw · warning · anyhow::Error

`auth paste-redirect` is not supported for this provider. On

Error message

`auth paste-redirect` is not supported for this provider. Only OpenAI Codex and Gemini expose a browser-based OAuth flow.

What it means

Default AuthProviderImpl::paste_redirect, used by providers without a browser OAuth flow. paste_redirect resumes a login by exchanging a pasted redirect URL/code; only the OpenAI Codex and Gemini implementations (and xAI's own override) have that flow, so any other provider hitting this method bails immediately. handle_auth_command dispatches `auth paste-redirect` here.

Source

Thrown at crates/zeroclaw-providers/src/auth/mod.rs:1064

        _profile: &str,
        _device_code: bool,
        _import: Option<&std::path::Path>,
    ) -> Result<()> {
        anyhow::bail!(
            "`auth login` is not supported for this provider. Use `auth paste-token` or \
             `auth setup-token` for bearer-token providers.",
        )
    }

    /// Resume an OAuth login from a paste-redirect URL/code. The default
    /// impl bails for providers that don't expose a browser flow.
    async fn paste_redirect(
        &self,
        _ctx: &AuthFlowContext<'_>,
        _profile: &str,
        _input: Option<&str>,
    ) -> Result<()> {
        anyhow::bail!(
            "`auth paste-redirect` is not supported for this provider. Only OpenAI Codex and \
             Gemini expose a browser-based OAuth flow.",
        )
    }

    /// Refresh the access token for `profile_override` (or active
    /// profile) and report status. Default impl bails for providers
    /// without a refresh flow.
    async fn refresh_status(
        &self,
        _ctx: &AuthFlowContext<'_>,
        _profile_override: Option<&str>,
    ) -> Result<RefreshStatus> {
        anyhow::bail!(
            "`auth refresh` is not supported for this provider. Only OpenAI Codex and Gemini \
             have an in-process token-refresh flow.",
        )
    }

View on GitHub (pinned to 88bb9c8533)

Solutions

Switch to the provider that actually has the flow: `zeroclaw auth paste-redirect --model-provider openai-codex` (or gemini / xai)
For non-OAuth providers use `auth paste-token` / `auth setup-token` instead
Verify a pending login exists first (`auth login` must have started it) before paste-redirect

Example fix

# before
zeroclaw auth paste-redirect --model-provider anthropic

# after
zeroclaw auth paste-redirect --model-provider openai-codex

Defensive patterns

Strategy: fallback

Try / catch

match provider.paste_redirect(ctx, profile, input).await {
    Ok(()) => Ok(()),
    Err(e) if e.to_string().contains("paste-redirect` is not supported") => {
        eprintln!("this provider has no browser OAuth flow; use auth paste-token");
        Err(e)
    }
    Err(e) => Err(e),
}

Prevention

Only run paste-redirect for openai-codex, gemini, and xai
Always pass --model-provider explicitly on auth subcommands

When it happens

Trigger: Running `zeroclaw auth paste-redirect --model-provider <provider>` for a bearer-token or otherwise non-browser provider (anything except openai-codex/gemini/xai).

Common situations: Following the Codex login tutorial against a different default provider, or forgetting to pass --model-provider so the command targets the wrong default.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/02b94e808cdbb767. Report an issue: GitHub.