Skip to main content

Overview

Auth internal errors are thrown by the authentication infrastructure — encryption contexts, credential vaults, token stores, session management, and provider registration. All are internal errors that should never be exposed to clients. For public-facing auth errors, see Auth Errors.

Encryption Errors

EncryptionContextNotSetError

Thrown when the encryption context is not set before an operation that requires it.

EncryptionKeyNotConfiguredError

Thrown when the encryption key is not configured.

Vault Errors

VaultLoadError

Thrown when loading a credential vault fails.
Example:

VaultNotFoundError

Thrown when a vault entity is not found.
Example:

Token Errors

TokenNotAvailableError

Thrown when a token is not available (e.g., expired or not yet obtained).

TokenStoreRequiredError

Thrown when a token store is required but not configured.
Example:

TokenLeakDetectedError

Thrown when a potential token leak is detected (e.g., token appearing in logs or responses).

Provider & Registration Errors

NoProviderIdError

Thrown when no provider ID is available during auth flow.

CredentialProviderAlreadyRegisteredError

Thrown when attempting to register a credential provider that is already registered.

AuthProvidersNotConfiguredError

Thrown when auth providers are not configured.

OrchestratedAuthNotAvailableError

Thrown when orchestrated auth is not available in the current context.

Session Errors

SessionSecretRequiredError

Thrown when a session secret is required but not configured.
Example:

SessionIdEmptyError

Thrown when a session ID is empty.

ElicitationSecretRequiredError

Thrown when the elicitation secret is required but not configured.

Scope & Access Errors

ScopeDeniedError

Thrown when scope access is denied for a provider.

InMemoryStoreRequiredError

Thrown when an in-memory store is required but not available.

OrchestratorJwksNotAvailableError

Thrown when the orchestrator JWKS endpoint is not available.

AuthInvalidInputError

Thrown when an auth API receives malformed input (e.g., invalid JWK, malformed scope string).

CredentialStorageError

Thrown when a credential storage operation fails (vault read/write, key persistence).

AuthFlowError

Thrown when a federated auth flow encounters an error (state mismatch, callback failure, etc.).