Hmbown/CodeWhale · error · anyhow::Error

DeepSeek API key not found. 1. Get a key: …

Error message

DeepSeek API key not found.

1. Get a key:  https://platform.deepseek.com/api_keys
2. Save it (works in every folder, no OS prompts):
codewhale auth set --provider deepseek

Alternatives:
• export DEEPSEEK_API_KEY=<your-key>      (current shell only;
also note: zsh users — exports in ~/.zshrc only reach interactive
shells, prefer ~/.zshenv for everything)
• api_key = "<your-key>"  in ~/.codewhale/config.toml
• already configured DeepSeek Harness? grant read-only access:
codewhale auth external-consent --provider deepseek --mode read-only

What it means

The DeepSeek/DeepSeek-CN credential resolution chain found no usable key and ended in this guided bail. The chain covers the explicit override path, [providers.deepseek] api_key, the durable auth store, the DEEPSEEK_API_KEY environment variable, and read-only external consent for an existing DeepSeek Harness file. The message lists each remediation with exact commands, including the zsh note that exports in ~/.zshrc only reach interactive shells.

Solutions

  1. Run 'codewhale auth set --provider deepseek' and paste the key (works in every folder, no OS prompts)
  2. Export DEEPSEEK_API_KEY in ~/.zshenv (zsh) or your login profile so non-interactive launches inherit it
  3. Add 'api_key = "sk-..."' under [providers.deepseek] (or [providers.deepseek-cn]) in ~/.codewhale/config.toml
  4. If DeepSeek Harness is already configured on the machine, grant read-only file access: codewhale auth external-consent --provider deepseek --mode read-only

Example fix

# before
$ export DEEPSEEK_API_KEY=   # empty
$ codewhale
# error: DeepSeek API key not found...

# after
$ codewhale auth set --provider deepseek
$ codewhale
Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight check before starting the TUI/CLI on a DeepSeek route:
use std::env;

fn deepseek_credential_present(config: &Config) -> bool {
    let route_key = config.provider_config_for(ApiProvider::Deepseek)
        .and_then(|e| e.api_key.as_deref())
        .is_some_and(|k| !k.trim().is_empty());
    let env_key = env::var("DEEPSEEK_API_KEY").is_ok_and(|v| !v.trim().is_empty());
    route_key || env_key || auth_store_has(ApiProvider::Deepseek)
}

Try / catch

match config.deepseek_api_key() {
    Err(e) if e.to_string().contains("DeepSeek API key not found") => {
        // run `codewhale auth set --provider deepseek` interactively, then retry startup
    }
    other => other?,
}

Prevention

When it happens

Trigger: provider is ApiProvider::Deepseek or ApiProvider::DeepseekCN, no custom endpoint, and every source in the resolution chain is empty: no --api-key, no configured api_key, nothing in the auth store, DEEPSEEK_API_KEY unset or blank, and no external-consent grant for the Harness credential file.

Common situations: First run after installing Codewhale; a key exported in one terminal but the TUI launched from another (or from a launcher that does not source the shell env); zsh users putting exports in ~/.zshrc where GUI-launched processes never see them; running 'codewhale auth logout' which clears stored keys.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/1d4f2094651184ad. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/config.rs:6659

            && (provider_route_is_keyless_self_hosted(provider, &self.deepseek_base_url())
                || base_url_uses_local_host(&self.deepseek_base_url()))
        {
            return Ok(String::new());
        }

        if custom_endpoint {
            let route_name = self
                .provider
                .as_deref()
                .unwrap_or_else(|| provider.as_str());
            anyhow::bail!(
                "Custom endpoint credentials for {route_name} must be bound explicitly. Ambient provider credentials are not sent to {}. Add api_key or api_key_env to this provider route, or pass --api-key with --base-url.",
                self.deepseek_base_url()
            );
        }

        match provider {
            ApiProvider::Deepseek | ApiProvider::DeepseekCN => anyhow::bail!(
                "DeepSeek API key not found.\n\
                 \n\
                 1. Get a key:  https://platform.deepseek.com/api_keys\n\
                 2. Save it (works in every folder, no OS prompts):\n\
                        codewhale auth set --provider deepseek\n\
                 \n\
                 Alternatives:\n\
                   • export DEEPSEEK_API_KEY=<your-key>      (current shell only;\n\
                     also note: zsh users — exports in ~/.zshrc only reach interactive\n\
                     shells, prefer ~/.zshenv for everything)\n\
                   • api_key = \"<your-key>\"  in ~/.codewhale/config.toml\n\
                   • already configured DeepSeek Harness? grant read-only access:\n\
                        codewhale auth external-consent --provider deepseek --mode read-only"
            ),
            ApiProvider::SiliconflowCn => anyhow::bail!(
                "SiliconFlow China API key not found. Get a key: {}. Run 'codewhale auth set --provider siliconflow-CN', \
                 set {}, or add [{}] api_key in ~/.codewhale/config.toml. \
                 [providers.siliconflow] remains a fallback when the CN table omits api_key.",

View on GitHub (pinned to 0c42157ee5)