Hmbown/CodeWhale · error · anyhow::Error

API key must be {MIN_API_KEY_BYTES}-{MAX_API_KEY_BYTES} UTF-

Error message

API key must be {MIN_API_KEY_BYTES}-{MAX_API_KEY_BYTES} UTF-8 bytes

What it means

API keys accepted by the CLI (from config, secret store, env var, stdin, or hidden prompt) must be between 8 and 4096 UTF-8 bytes after trimming. This bail fires when the supplied key is shorter than 8 bytes or longer than 4096, catching empty, placeholder, and wrongly-pasted values before they reach the network.

Source

Thrown at crates/cli/src/cloud.rs:881

    }
    Ok(())
}

fn validate_device_code(code: &str) -> Result<()> {
    if code.len() != 43
        || !code
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
    {
        bail!("The Codewhale service returned an invalid device authorization response");
    }
    Ok(())
}

fn validate_api_key(key: &str) -> Result<()> {
    let bytes = key.len();
    if bytes < MIN_API_KEY_BYTES || bytes as u64 > MAX_API_KEY_BYTES {
        bail!("API key must be {MIN_API_KEY_BYTES}-{MAX_API_KEY_BYTES} UTF-8 bytes");
    }
    if key.chars().any(is_ascii_control) {
        bail!("API key contains invalid control characters");
    }
    Ok(())
}

fn validate_label(label: &str) -> Result<String> {
    let label = label.split_whitespace().collect::<Vec<_>>().join(" ");
    if label.is_empty()
        || label.chars().count() > MAX_KEY_LABEL_CHARS
        || label.chars().any(is_ascii_control)
    {
        bail!("key label must contain 1-{MAX_KEY_LABEL_CHARS} characters");
    }
    Ok(label)
}

View on GitHub (pinned to 0c42157ee5)

Solutions

  1. Re-copy the key and verify it is the raw token (typically 20-60 chars), not a JSON blob, URL, or 'Bearer'-prefixed string
  2. If the key legitimately exceeds 4096 bytes, obtain a standard-length key from the provider
  3. Check the env var (e.g. DEEPSEEK_API_KEY) for stray quotes, prefixes, or interpolation issues
  4. For stdin, echo exactly the key: printf '%s' "$KEY" | codewhale ... --api-key-stdin

Example fix

# before
cat account-credentials.json | codewhale cloud login --api-key-stdin
# after
printf '%s' "sk-actual-key-value" | codewhale cloud login --api-key-stdin
Defensive patterns

Strategy: validation

Validate before calling

const MIN_API_KEY_BYTES: usize = 8;
const MAX_API_KEY_BYTES: u64 = 4096;

fn api_key_len_ok(key: &str) -> bool {
    let bytes = key.trim().len();
    (MIN_API_KEY_BYTES..=MAX_API_KEY_BYTES as usize).contains(&bytes)
}

Type guard

fn is_valid_api_key(key: &str) -> bool {
    let k = key.trim();
    (8..=4096).contains(&k.len())
        && !k.chars().any(|c| c <= '\u{001f}' || c == '\u{007f}')
}

Prevention

When it happens

Trigger: Passing an empty string, a 4-char placeholder like 'test', an email address, a whole JSON credential file, or a >4KiB token via --api-key-stdin, hidden prompt, config api_key, or provider env var.

Common situations: Piping the wrong file into --api-key-stdin (a JSON key file instead of the raw key); env vars containing quotes or 'Bearer ' prefixes making the value unexpected; copy-paste that misses characters; Windows CRLF adding bytes (handled by trim) or multi-line PEM blocks exceeding 4096 bytes.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/684f796516a7f503. Report an issue: GitHub.