Hmbown/CodeWhale · error · anyhow::Error

bearer credentials are not an API key

Error message

bearer credentials are not an API key

What it means

Guard in resolve_api_key for OpenaiCodex: the runtime credential source is not the CLI-provided API key slot but an OAuth bearer token, which the handoff refuses to emit as an API key since bearer credentials are not interchangeable with API keys.

Source

Thrown at crates/cli/src/credential_handoff.rs:50

        secrets,
    );
    if resolved.provider != provider {
        bail!("resolved a different provider");
    }
    let source = resolved.api_key_source;
    if source != Some(RuntimeApiKeySource::Cli) {
        if provider == ProviderKind::OpenaiCodex {
            bail!("bearer credentials are not an API key");
        }
        let uses_api_key = provider != ProviderKind::Xai
            || xai_auth_diagnostics(store, runtime_overrides).evaluates_runtime_api_key();
        ensure!(uses_api_key, "OAuth bearer credentials are not an API key");
        let kimi_bearer = provider == ProviderKind::Moonshot
            && resolved
                .auth_mode
                .as_deref()
                .is_some_and(auth_mode_uses_kimi_imported_token);
        ensure!(!kimi_bearer, "bearer credentials are not an API key");
    }
    ensure!(source.is_some(), "no runtime-effective API key");
    resolved
        .api_key
        .filter(|value| !value.trim().is_empty())
        .context("no usable runtime-effective API key")
}

pub(crate) fn handoff_secret_line(
    writer: &mut impl Write,
    stdout_is_terminal: bool,
    resolve: impl FnOnce() -> Result<String>,
) -> Result<()> {
    prepare_stdout(stdout_is_terminal)?;
    let secret = Zeroizing::new(resolve().map_err(|_| anyhow::anyhow!("unavailable credential"))?);
    ensure!(!secret.trim().is_empty(), "credential handoff was empty");
    let written = writeln!(writer, "{}", secret.as_str());
    if written.is_ok() || written.is_err_and(|error| error.kind() == ErrorKind::BrokenPipe) {

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Configure an explicit API key for the provider route so the CLI slot holds a real key.
2. Use an OAuth-aware handoff path rather than the API-key handoff when bearer credentials are in effect.
3. Switch the provider auth mode to API-key based if a handoff key is required.

When it happens

Trigger: Thrown at crates/cli/src/credential_handoff.rs:50 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/807c6ed638e9f856. Report an issue: GitHub.