Hmbown/CodeWhale · error

API key input is unexpectedly large

Error message

API key input is unexpectedly large

What it means

When reading an API key from stdin, the CLI reads at most MAX_API_KEY_STDIN_BYTES = 5120 bytes (4096 max key + 1024 slack) and rejects anything larger before parsing. This bail fires when the piped input exceeds that cap, protecting against accidentally piping files or unbounded streams into the key prompt.

Source

Thrown at crates/cli/src/cloud.rs:964

        return None;
    }
    std::env::var(variable)
        .ok()
        .filter(|value| !value.trim().is_empty())
}

fn read_key_from_stdin() -> Result<String> {
    let mut bytes = Vec::new();
    io::stdin()
        .take(MAX_API_KEY_STDIN_BYTES + 1)
        .read_to_end(&mut bytes)
        .context("failed to read API key from stdin")?;
    parse_key_input(bytes)
}

fn parse_key_input(bytes: Vec<u8>) -> Result<String> {
    if bytes.len() as u64 > MAX_API_KEY_STDIN_BYTES {
        bail!("API key input is unexpectedly large");
    }
    let value = String::from_utf8(bytes).context("API key from stdin is not valid UTF-8")?;
    let value = value.trim().to_string();
    validate_api_key(&value)?;
    Ok(value)
}

fn read_key_hidden(provider: &str) -> Result<String> {
    if !io::stdin().is_terminal() {
        bail!("interactive key entry requires a terminal; use `--api-key-stdin` for piped input");
    }
    let term = console::Term::stderr();
    term.write_str(&format!("Enter {provider} API key: "))
        .context("failed to write API key prompt")?;
    let value = term
        .read_secure_line()
        .context("failed to read API key securely")?;
    term.write_line("").ok();

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Pipe only the raw key: printf '%s' "$KEY" | codewhale ... --api-key-stdin
2. Extract the key field first: jq -r .api_key creds.json | codewhale ... --api-key-stdin
3. Verify the source file: wc -c key.txt must be <= 5120 (and the trimmed key <= 4096)
4. If you genuinely have a huge token, it is not a supported API key - issue a standard-length key

Example fix

# before
cat ./service-account-credentials.json | codewhale cloud login --api-key-stdin
# after
jq -r .api_key ./service-account-credentials.json | tr -d '\n' | codewhale cloud login --api-key-stdin

const MAX_API_KEY_STDIN_BYTES: u64 = 5120; // 4096 key + 1024 slack

fn stdin_size_ok() -> std::io::Result<bool> {
    use std::io::{Seek, SeekFrom};
    let mut f = std::io::stdin().lock();
    if f.seek(SeekFrom::End(0))? <= MAX_API_KEY_STDIN_BYTES as i64 {
        f.seek(SeekFrom::Start(0))?;
        Ok(true)
    } else {
        Ok(false)
    }
}

When it happens

Trigger: `cat large-file.json | codewhale ... --api-key-stdin` where the file is >5 KiB; piping a full docker-credentials JSON, PEM bundle, or config file instead of the bare key; a stuck pipe that keeps producing output.

Common situations: Automation scripts reusing a generic `cat $CREDS | ...` pattern for all secret inputs; accidentally piping the wrong file; keys embedded in larger response bodies that were never extracted.

Related errors

• interactive key entry requires a terminal; use `--api-key-st
• API key must be {MIN_API_KEY_BYTES}-{MAX_API_KEY_BYTES} UTF-
• API key contains invalid control characters
• key label must contain 1-{MAX_KEY_LABEL_CHARS} characters
• No API key provided. Pass --api-key or pipe one via stdin.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/ac6b88329514a404. Report an issue: GitHub.