Hmbown/CodeWhale · error · anyhow::Error

OAuth bearer credentials are not an API key

Error message

OAuth bearer credentials are not an API key

What it means

Resolved-provider guard in resolve_api_key: after resolving runtime options with secrets, the active provider differs from the requested provider kind. The handoff must only emit a credential for the provider actually in effect, so a mismatch is rejected.

Source

Thrown at crates/cli/src/credential_handoff.rs:44

    secrets: &Secrets,
    provider: ProviderKind,
    runtime_overrides: &CliRuntimeOverrides,
) -> Result<String> {
    let resolved = store.config.resolve_runtime_options_with_secrets(
        &runtime_overrides_for_provider(runtime_overrides, provider),
        secrets,
    );
    if resolved.provider != provider {
        bail!("resolved a different provider");
    }
    let source = resolved.api_key_source;
    if source != Some(RuntimeApiKeySource::Cli) {
        if provider == ProviderKind::OpenaiCodex {
            bail!("bearer credentials are not an API key");
        }
        let uses_api_key = provider != ProviderKind::Xai
            || xai_auth_diagnostics(store, runtime_overrides).evaluates_runtime_api_key();
        ensure!(uses_api_key, "OAuth bearer credentials are not an API key");
        let kimi_bearer = provider == ProviderKind::Moonshot
            && resolved
                .auth_mode
                .as_deref()
                .is_some_and(auth_mode_uses_kimi_imported_token);
        ensure!(!kimi_bearer, "bearer credentials are not an API key");
    }
    ensure!(source.is_some(), "no runtime-effective API key");
    resolved
        .api_key
        .filter(|value| !value.trim().is_empty())
        .context("no usable runtime-effective API key")
}

pub(crate) fn handoff_secret_line(
    writer: &mut impl Write,
    stdout_is_terminal: bool,
    resolve: impl FnOnce() -> Result<String>,

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Align the requested provider with the currently configured/resolved runtime provider.
2. Remove or correct runtime overrides that redirect resolution to another provider.
3. Update config so the intended provider is the one actually active.

When it happens

Trigger: Thrown at crates/cli/src/credential_handoff.rs:44 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/4f3a5abc71864834. Report an issue: GitHub.