Kimi is API-key-only in Codewhale. Create a key at…

Error message

Kimi is API-key-only in Codewhale. Create a key at https://platform.kimi.ai/console/api-keys; Kimi CLI OAuth import is unsupported.

What it means

When resolving an external CLI credential source for a provider, ProviderKind::Moonshot is explicitly rejected: Kimi is API-key-only in Codewhale and its CLI OAuth credential import is unsupported. The bail names the Kimi console URL where a key can be created.

Solutions

Create an API key at https://platform.kimi.ai/console/api-keys
Set it via `codewhale auth set --provider kimi` or `--api-key-stdin` instead of CLI import

Example fix

// before
codewhale auth import --provider kimi
// after
printf '%s' "$KIMI_API_KEY" | codewhale auth set --provider kimi --api-key-stdin

Defensive patterns

Strategy: validation

Validate before calling

SUPPORTED_CLI_IMPORT = ['grok', 'deepseek'];
if provider === 'kimi' || provider === 'moonshot': raise SystemExit('kimi is API-key-only; create a key at platform.kimi.ai')

Prevention

Check per-provider auth docs before scripting import flows
Provision Kimi via API key in the secrets manager, not CLI OAuth

When it happens

Trigger: Invoking an external-credential import path (e.g. `codewhale auth import`-style commands) with --provider pointing at Kimi/Moonshot.

Common situations: Users who installed Kimi CLI and expect Codewhale to import its OAuth token the way it does for Grok/Deepseek CLIs; docs or scripts generalized across providers.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/997330a391bf96f3. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/lib.rs:2819

fn external_credential_target(
    provider: ProviderKind,
    path_override: Option<PathBuf>,
) -> Result<(codewhale_config::ExternalCredentialSource, PathBuf)> {
    let (source, default_path) = match provider {
        ProviderKind::OpenaiCodex => (
            codewhale_config::ExternalCredentialSource::CodexCli,
            openai_codex_auth_file_path(),
        ),
        ProviderKind::Xai => (
            codewhale_config::ExternalCredentialSource::GrokCli,
            grok_auth_file_path(),
        ),
        ProviderKind::Deepseek | ProviderKind::DeepseekAnthropic => (
            codewhale_config::ExternalCredentialSource::DshCli,
            codewhale_config::default_dsh_credentials_path(),
        ),
        ProviderKind::Moonshot => bail!(
            "Kimi is API-key-only in Codewhale. Create a key at https://platform.kimi.ai/console/api-keys; Kimi CLI OAuth import is unsupported."
        ),
        _ => bail!(
            "{} has no supported external CLI credential source",
            provider.as_str()
        ),
    };
    let path =
        codewhale_config::resolve_external_credential_path(path_override.unwrap_or(default_path))?;
    Ok((source, path))
}

fn provider_config_api_key(store: &ConfigStore, provider: ProviderKind) -> Option<&str> {
    let slot = store
        .config
        .providers
        .for_provider(provider)
        .api_key

View on GitHub (pinned to 73e0f67d83)