What causes "external credential consent for {}: {error}" in Hmbown/CodeWhale?

Re-run the credential consent flow for this provider to recreate the grant, then retry

external credential consent for

Error message

external credential consent for {}: {error}

What it means

Wraps a failure from `consent.read_grant` when loading an externally-stored credential (e.g. an API key kept outside the app's secret store). The error carries the provider display name plus the underlying consent error, so the user knows which provider's consent grant could not be read. Without a valid grant the credential cannot be used, and startup/route resolution fails rather than silently proceeding.

Solutions

Re-run the credential consent flow for this provider to recreate the grant, then retry
Check the consent file at `consent.path` exists and is readable by the current user
Verify the credential kind and source match what the grant was issued for; re-grant if the source changed

Defensive patterns

Strategy: try-catch

Validate before calling

if !consent.path.exists() {
    return Err(anyhow!("no consent grant for {} at {}", kind, consent.path.display()));
}

Try / catch

match load_external_credential(provider) {
    Err(e) if e.to_string().starts_with("external credential consent for") => {
        prompt_re_consent(provider);
    }
    other => other,
}

Prevention

Re-run the consent flow after changing credential kind, source, or machine
Back up consent grant files alongside credentials when migrating environments
Check file permissions on the consent path before automating credential loads

When it happens

Trigger: Resolving credentials for a provider whose external credential consent grant is missing, unreadable, or invalid: `read_grant(kind, source, &consent.path)` returns Err and the message is formatted as `external credential consent for {provider}: {error}`.

Common situations: The consent grant file was deleted or has wrong permissions; the grant was created for a different credential kind/source; copying credentials between machines without the consent record.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/36cb5e2db9d8ffe6. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/config.rs:6938

            .metadata()
            .map(codewhale_config::provider::Provider::kind)
            .context("external credentials are unsupported for this provider")?;
        let consent = self
            .provider_config_for(provider)
            .and_then(|entry| entry.external_credentials.as_ref())
            .with_context(|| {
                format!(
                    "External credentials owned by {} are disabled for {}. To allow read-only access to this exact file, run:\n  codewhale auth external-consent --provider {} --mode read-only --path {}",
                    source.as_str(),
                    provider.display_name(),
                    kind.as_str(),
                    codewhale_config::quote_os_path(suggested_path)
                )
            })?;
        consent
            .read_grant(kind, source, &consent.path)
            .map_err(|error| {
                anyhow::anyhow!(
                    "external credential consent for {}: {error}",
                    provider.display_name()
                )
            })
    }

    /// Whether a structurally valid read-only consent record exists for an
    /// external credential source. This never stats or reads the selected
    /// file and never mints the capability required to do so.
    pub(crate) fn external_credential_read_consent_configured(
        &self,
        provider: ApiProvider,
        source: codewhale_config::ExternalCredentialSource,
    ) -> bool {
        let Some(kind) = provider
            .metadata()
            .map(codewhale_config::provider::Provider::kind)
        else {

View on GitHub (pinned to 73e0f67d83)