No local API key was found in config, the secret store, or…

Error message

No local {} API key was found in config, the secret store, or the environment

What it means

Thrown by the cloud `keys` set command after `local_kind()` succeeded but `resolve_local_key` returned None — meaning the provider has a local runtime kind, but no key for that kind was found in the config file, the secret store, or the environment. The error names all three lookup locations so the user knows where to put the key.

Solutions

Set the local API key first (config, secret store, or export the expected env var), then retry `--from-local`.
Or skip `--from-local` and provide the key directly with `--api-key-stdin` or the hidden prompt.
Verify the key is stored under the exact provider/kind the catalog's `local_kind()` reports (`kind.as_str()` in the message).
Check environment variable names and that the shell session actually has them exported.

Example fix

// before
codewhale cloud keys set --provider openai --from-local   # no local key anywhere
// after
export OPENAI_API_KEY=sk-...
codewhale cloud keys set --provider openai --from-local

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the local key exists before --from-local
if std::env::var("OPENAI_API_KEY").is_err() { eprintln!("local API key not found in config, secret store, or env"); }

Try / catch

match set_key_from_local(provider) {
    Err(e) if e.to_string().contains("No local") => {
        // prompt for the key or use --api-key-stdin
    }
    other => other?,
}

Prevention

Configure the local key (config, secret store, or env) before --from-local
Match the exact kind string the catalog reports
On fresh machines, run a key-availability check first

When it happens

Trigger: Running `cloud keys set --from-local` where the provider's local kind exists but no matching API key is configured anywhere locally (config, OS secret store, env vars).

Common situations: Fresh machine without a configured key; key stored under a different provider/kind name than the catalog expects; env var not exported in the current shell; secret store locked or not initialized.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/7280aabc3bfd26f0. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/cloud.rs:848

                        _ => "not set".to_string(),
                    };
                    writeln!(out, "{}: {status} — {}", row.id, row.display_label())?;
                }
                Ok(())
            }
            CloudKeysCommand::Set(set) => {
                let provider = validate_provider_id(&set.provider)?;
                let user = client.me()?;
                let catalog = client.provider_catalog()?;
                let row = catalog_row(&catalog, &provider)?;
                let key = if set.from_local {
                    let kind = row.local_kind().ok_or_else(|| {
                        anyhow!(
                            "`{provider}` has no local runtime provider, so there is no local key to copy. Use `--api-key-stdin` or the hidden prompt"
                        )
                    })?;
                    resolve_local_key(config, provider_secrets, kind)?.ok_or_else(|| {
                        anyhow!(
                            "No local {} API key was found in config, the secret store, or the environment",
                            kind.as_str()
                        )
                    })?
                } else if set.api_key_stdin {
                    key_reader(KeyReadMode::Stdin)?
                } else {
                    key_reader(KeyReadMode::HiddenPrompt(provider.clone()))?
                };
                let key = key.trim().to_string();
                validate_api_key(&key)?;
                let label = validate_label(&set.label)?;
                client.set_key(&provider, &key, &label)?;
                writeln!(
                    out,
                    "Saved {provider} for Codewhale account {} (profile {}).",
                    printable(&user.id),
                    printable(profile)

View on GitHub (pinned to 73e0f67d83)