# Atlas error: Provider auth error, API key missing or invalid (ProviderAuthError) > Run `atlas auth login` and re-add the credential for the provider named in the error, then retry the message. Atlas fails the assistant message with a ProviderAuthError naming the providerID because the API key for that provider is missing or invalid: message-v2's toError catches the AI SDK LoadAPIKeyError and converts it into Atlas's ProviderAuthError carrying the providerID and the underlying message. Fix it by running `atlas auth login` and re-adding the credential for the provider named in the error, confirming any env var you rely on is exported in the same shell that launches Atlas, and deleting the stale entry from Atlas auth storage before re-adding it. ## Symptom The assistant message fails with a ProviderAuthError naming the providerID, and the Atlas TUI renders it as an error banner rather than a normal reply. The turn never produces an answer. ## Cause The API key for the provider is missing or invalid. message-v2's toError catches the AI SDK LoadAPIKeyError and converts it into Atlas's ProviderAuthError, carrying the providerID and the underlying message so the TUI can name the failing provider. ## Fix 1. Run `atlas auth login` and re-add the credential for the provider named in the error. 2. If you rely on an env var, confirm it is exported in the same shell that launches Atlas, not just in your dotfiles. 3. Delete the stale entry from Atlas auth storage and re-add it. Auth.set writes the file with mode 0o600. 4. Retry the message. ProviderAuthError is part of the shared error union, so the Atlas TUI shows it inline if it recurs. ## Why does Atlas show a ProviderAuthError banner Atlas shows a ProviderAuthError banner because the AI SDK threw LoadAPIKeyError for that provider. message-v2's toError catches LoadAPIKeyError and converts it into Atlas's ProviderAuthError, carrying the providerID and the underlying message, so the TUI can name exactly which provider failed. ProviderAuthError is a translation, not a guess. The AI SDK raises LoadAPIKeyError when the API key it needs is missing or invalid, and message-v2's toError catches that specific error type and wraps it as ProviderAuthError with the providerID attached. Because the providerID travels with the error, the Atlas TUI can render an error banner that names the failing provider rather than showing a generic authentication complaint. The message never becomes a normal reply. It becomes an error banner in the transcript, which is the correct behavior for a failure that no retry can resolve until the credential itself changes. ## How do I fix ProviderAuthError in Atlas Step 1 of the documented fix is to run `atlas auth login` and re-add the credential for the provider named in the error. The providerID is carried on the ProviderAuthError itself, so you never have to guess which of your configured providers has the missing or invalid API key. Re-add the credential rather than inspecting the one already stored. Copy the key from the provider dashboard so you know you are entering a current value, and run `atlas auth login` for the provider whose providerID appears in the ProviderAuthError. Retyping a remembered key is the most common way this fix fails. Once the credential is written, retry the message. ProviderAuthError is part of the shared error union rendered in the TUI, so if the key is still wrong you will see the same banner inline immediately rather than having to dig through logs to find out. ## Why Atlas does not see your exported API key env var Step 2 of the documented fix is to confirm the API key env var is exported in the same shell that actually launches Atlas, not just written in your dotfiles. The AI SDK throws LoadAPIKeyError for a variable the Atlas process cannot read, and Atlas converts that into ProviderAuthError. Environment variable scope is the quiet cause behind a large share of ProviderAuthError reports. A key added to a dotfile that the current shell never sourced, a key exported in a different terminal tab, or a key set inside a shell that then launched Atlas indirectly can all be invisible to the Atlas process. The AI SDK sees no key, throws LoadAPIKeyError, and message-v2's toError turns that into ProviderAuthError with the providerID attached. Print the variable in the shell you are about to launch Atlas from. If it is not there, Atlas cannot read it either. ## How to clear a stale credential from Atlas auth storage Delete the stale entry from Atlas auth storage and re-add it when a rotated or revoked key keeps producing ProviderAuthError. Atlas writes the credential file through Auth.set with mode 0o600, so the replacement entry is stored with owner-only read and write permissions. A key that was valid when you stored it can be rotated or revoked later, and the stale value sitting in Atlas auth storage will keep producing LoadAPIKeyError on every request. Removing the entry outright, rather than layering a new value over an old one, is the reliable path. When you re-add the credential, Auth.set writes the file with mode 0o600, which keeps the stored key readable only by your user account. Confirming that the file permission is 0o600 also tells you the write went through Atlas auth storage rather than being left somewhere Atlas will not read from. ## How to verify the Atlas API key fix worked Step 4 of the documented fix is to retry the message. ProviderAuthError is part of the shared error union rendered in the Atlas TUI, so a recurrence appears inline as an error banner rather than a silent failure. A normal assistant reply means the AI SDK loaded the API key successfully. Retrying is a fast and honest test because the error surfaces immediately. If the key is now valid, the message completes and you get a normal reply instead of a banner. If the same ProviderAuthError banner returns with the same providerID, the AI SDK is still throwing LoadAPIKeyError, which means the credential Atlas is reading is still missing or invalid. At that point, work the two sources in order: re-run `atlas auth login`, then confirm the env var is exported in the shell that launches Atlas. One of those two is where the wrong value is coming from. ## What ProviderAuthError does not mean in Atlas ProviderAuthError in Atlas does not mean the model is unavailable, your quota is spent, or the prompt was too long. Those are 3 separate errors. ProviderAuthError exists specifically because the AI SDK threw LoadAPIKeyError, which is a missing or invalid API key for the providerID named in the error banner. Read the providerID on the error and take the message at face value. Switching models within the same provider will not help, because the same missing or invalid key is used regardless of which model you select. Shortening the prompt will not help. Billing is not the issue. The one caveat worth naming: ProviderAuthError carries the underlying message from the AI SDK, so if the provider gave a more specific reason for rejecting the key, that detail travels with the error and is worth reading before you assume the key is merely absent. ## FAQ ### how to fix ProviderAuthError in atlas Run `atlas auth login` and re-add the credential for the provider named in the error. If you use an env var, confirm it is exported in the same shell that launches Atlas, then delete the stale entry from Atlas auth storage and re-add it. ### what is LoadAPIKeyError in atlas LoadAPIKeyError is the AI SDK error for a missing or invalid API key. message-v2's toError catches it and converts it into Atlas's ProviderAuthError, which carries the providerID and the underlying message. ### atlas says api key missing but I set the env var Confirm the env var is exported in the same shell that launches Atlas, not just in your dotfiles. A variable the Atlas process cannot read causes the AI SDK to throw LoadAPIKeyError, which Atlas reports as ProviderAuthError. ### how do I remove an old api key from atlas Delete the stale entry from Atlas auth storage and re-add the credential. Auth.set writes the credential file with mode 0o600, so the replacement is stored with owner-only permissions. ### why does the atlas TUI show my auth error as a banner ProviderAuthError is part of the shared error union rendered in the Atlas TUI, so a failed message is shown inline as an error banner instead of becoming a normal assistant reply. ### will changing models fix an atlas provider auth error No. ProviderAuthError comes from a missing or invalid API key for the providerID named in the error, and the same credential is used for every model on that provider. Re-add the credential with `atlas auth login` instead. ### what file permission does atlas use for stored credentials Atlas Auth.set writes the credential file with mode 0o600, which restricts read and write access to the owning user account. --- Canonical HTML: https://runatlas.sh/resources/troubleshooting/provider-auth-error-missing-api-key Source of truth: aeo_pages row `/resources/troubleshooting/provider-auth-error-missing-api-key` (segment: Troubleshooting) (this file is generated from it, never hand-edited). Licence: Atlas is proprietary with a free core. It is not open source and there is no public source repository.