Kimi is API-key-only in Codewhale. Create a key at https://p

Error message

Kimi is API-key-only in Codewhale. Create a key at https://platform.kimi.ai/console/api-keys; Kimi CLI OAuth import is unsupported.

What it means

Codewhale deliberately refuses external CLI credential import for the Moonshot/Kimi provider: `external_credential_target` has no credential-source mapping for it because Kimi is API-key-only in Codewhale. The message points to the Kimi console where an API key can be created, since importing Kimi CLI OAuth state is unsupported.

Source

Thrown at crates/cli/src/lib.rs:2523

) -> Result<(codewhale_config::ExternalCredentialSource, PathBuf)> {
    let (source, default_path) = match provider {
        ProviderKind::OpenaiCodex => (
            codewhale_config::ExternalCredentialSource::CodexCli,
            openai_codex_auth_file_path(),
        ),
        ProviderKind::Xai => (
            codewhale_config::ExternalCredentialSource::GrokCli,
            grok_auth_file_path(),
        ),
        ProviderKind::Deepseek | ProviderKind::DeepseekAnthropic => (
            codewhale_config::ExternalCredentialSource::DshCli,
            codewhale_config::default_dsh_credentials_path(),
        ),
        ProviderKind::Antigravity => (
            codewhale_config::ExternalCredentialSource::AgyCli,
            codewhale_config::default_agy_credentials_path(),
        ),
        ProviderKind::Moonshot => bail!(
            "Kimi is API-key-only in Codewhale. Create a key at https://platform.kimi.ai/console/api-keys; Kimi CLI OAuth import is unsupported."
        ),
        _ => bail!(
            "{} has no supported external CLI credential source",
            provider.as_str()
        ),
    };
    let path =
        codewhale_config::resolve_external_credential_path(path_override.unwrap_or(default_path))?;
    Ok((source, path))
}

fn provider_config_api_key(store: &ConfigStore, provider: ProviderKind) -> Option<&str> {
    let slot = store
        .config
        .providers
        .for_provider(provider)
        .api_key

View on GitHub (pinned to 0c42157ee5)

Solutions

Create an API key at https://platform.kimi.ai/console/api-keys
Store the key through Codewhale's own API-key path (e.g. `codewhale auth` API-key setup / `CODEWHALE_API_KEY`-style config for the provider) instead of CLI import
Update scripts to skip kimi/moonshot in provider-import loops

Example fix

# before
$ codewhale external-credentials --provider kimi ...
# Kimi is API-key-only in Codewhale...

# after
$ export MOONSHOT_API_KEY=sk-...   # or codewhale auth api-key flow
$ codewhale --provider kimi exec "hello"

Defensive patterns

Strategy: validation

Validate before calling

#!/usr/bin/env bash
provider="kimi"
if [ "$provider" = "kimi" ] || [ "$provider" = "moonshot" ]; then
  [ -n "$MOONSHOT_API_KEY" ] || { echo "set MOONSHOT_API_KEY (create at platform.kimi.ai)" >&2; exit 1; }
fi
codewhale --provider "$provider" exec "hello"

Type guard

fn supports_external_cli_import(provider: &str) -> bool {
    matches!(provider, "codex" | "grok" | "deepseek" | "dsh" | "antigravity" | "agy")
}

Prevention

Keep Kimi/Moonshot provisioning API-key-based from the start; do not plan around OAuth import
In multi-provider import scripts, special-case moonshot to configure an API key instead

When it happens

Trigger: Any command that resolves an external CLI credential target for the Moonshot provider, e.g. configuring external credential access with `--provider kimi`/moonshot (the external-credentials surface or login-import path).

Common situations: Users who authenticated Kimi's own CLI trying to reuse that OAuth session in Codewhale; automation scripts that loop over all providers attempting credential import.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/997330a391bf96f3. Report an issue: GitHub.