`codewhale login` now signs in to your Codewhale account…

Error message

`codewhale login` now signs in to your Codewhale account via the browser device flow. To configure a provider key, run `codewhale auth set --provider <provider>` (hidden prompt) or `codewhale auth set --provider <provider> --api-key-stdin`.

What it means

`codewhale login` was repurposed as the Codewhale account browser device-flow sign-in; provider/API-key arguments on login are legacy and now hard-fail with a redirect message naming `auth set`. The legacy flags remain hidden-parseable only so this helpful message can be shown instead of an unknown-flag error.

Solutions

Use `codewhale login` alone for Codewhale account sign-in
Configure the provider key with `codewhale auth set --provider <provider>` (hidden interactive prompt)
For non-interactive setup use `codewhale auth set --provider <provider> --api-key-stdin` with the key piped to stdin

Example fix

// before
codewhale login --provider openai --api-key sk-...
// after
codewhale auth set --provider openai --api-key-stdin < key.txt

Defensive patterns

Strategy: validation

Validate before calling

// shell
if [[ "$cmd" == *"login --provider"* || "$cmd" == *"login --api-key"* ]]; then echo "use: codewhale auth set --provider <p>"; exit 1; fi

Prevention

Use `codewhale login` only for Codewhale account sign-in
Use `codewhale auth set` for all provider keys; update old setup scripts

When it happens

Trigger: Running `codewhale login --provider <p>` or `codewhale login --api-key <key>` (or any combination where either legacy arg is set).

Common situations: CI scripts or dotfiles from older Codewhale versions that authenticated providers via `login`; users following outdated blog posts or README snippets; migrating setup from a machine where login-then-key was the flow.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/41cca9860bde5b67. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/lib.rs:2532

        let flag = arg.split_once('=').map_or(arg.as_str(), |(flag, _)| flag);
        if GLOBAL_ONLY_FLAGS.contains(&flag) {
            bail!(
                "{flag} must be placed before `exec`.\n\nUse:\n  codewhale {flag} <value> exec \"<prompt>\""
            );
        }
    }

    Ok(())
}

/// `codewhale login` used to configure provider API keys; that surface moved
/// to `auth set --provider`. The hidden legacy flags stay parseable so the
/// redirect below can name the replacement instead of an unknown-flag error.
fn reject_legacy_login_provider_args(args: &LoginArgs) -> Result<()> {
    if args.api_key.is_none() && args.provider.is_none() {
        return Ok(());
    }
    bail!(
        "`codewhale login` now signs in to your Codewhale account via the browser device flow. \
         To configure a provider key, run `codewhale auth set --provider <provider>` (hidden prompt) \
         or `codewhale auth set --provider <provider> --api-key-stdin`."
    )
}

fn run_logout_command(store: &mut ConfigStore, profile: Option<&str>) -> Result<()> {
    run_logout_command_with_secrets(store, &Secrets::auto_detect(), profile)
}

fn run_logout_command_with_secrets(
    store: &mut ConfigStore,
    secrets: &Secrets,
    profile: Option<&str>,
) -> Result<()> {
    codewhale_config::with_xai_oauth_revocation_transaction(|| {
        run_logout_command_with_secrets_unlocked(store, secrets, profile)
    })

View on GitHub (pinned to 73e0f67d83)