Hmbown/CodeWhale · error · anyhow::Error

SiliconFlow China API key not found. Get a key: {}. Run 'cod

Error message

SiliconFlow China API key not found. Get a key: {}. Run 'codewhale auth set --provider siliconflow-CN', set {}, or add [{}] api_key in ~/.codewhale/config.toml. [providers.siliconflow] remains a fallback when the CN table omits api_key.

What it means

Raised for ApiProvider::SiliconflowCn when no credential exists for the China route. The CN route has its own auth store entry, env var, and [providers.siliconflow-CN] table; the generic [providers.siliconflow] table still works as a fallback when the CN table omits api_key. The message interpolates the credential URL, env-var label, and table name.

Source

Thrown at crates/tui/src/config.rs:6368

        }

        match provider {
            ApiProvider::Deepseek | ApiProvider::DeepseekCN => anyhow::bail!(
                "DeepSeek API key not found.\n\
                 \n\
                 1. Get a key:  https://platform.deepseek.com/api_keys\n\
                 2. Save it (works in every folder, no OS prompts):\n\
                        codewhale auth set --provider deepseek\n\
                 \n\
                 Alternatives:\n\
                   • export DEEPSEEK_API_KEY=<your-key>      (current shell only;\n\
                     also note: zsh users — exports in ~/.zshrc only reach interactive\n\
                     shells, prefer ~/.zshenv for everything)\n\
                   • api_key = \"<your-key>\"  in ~/.codewhale/config.toml\n\
                   • already configured DeepSeek Harness? grant read-only access:\n\
                        codewhale auth external-consent --provider deepseek --mode read-only"
            ),
            ApiProvider::SiliconflowCn => anyhow::bail!(
                "SiliconFlow China API key not found. Get a key: {}. Run 'codewhale auth set --provider siliconflow-CN', \
                 set {}, or add [{}] api_key in ~/.codewhale/config.toml. \
                 [providers.siliconflow] remains a fallback when the CN table omits api_key.",
                provider
                    .credential_url()
                    .unwrap_or("https://cloud.siliconflow.com/account/ak"),
                provider.env_vars_label(),
                provider_config_table_name(provider)?
            ),
            ApiProvider::Moonshot => {
                let credential_help =
                    credential_help_for_provider_route(provider, &self.deepseek_base_url());
                if moonshot_base_url_is_exact_kimi_code(&self.deepseek_base_url()) {
                    anyhow::bail!(
                        "Kimi Code membership-plan API key not found. Get a plan key: {}. This route uses api.kimi.com/coding/v1 and does not import Kimi CLI credentials. Run 'codewhale auth set --provider moonshot', set {}, or add [{}] api_key.",
                        credential_help
                            .credential_url
                            .unwrap_or(KIMI_CODE_MEMBERSHIP_PLAN_CONSOLE_URL),

View on GitHub (pinned to 8880682c63)

Solutions

  1. Run codewhale auth set --provider siliconflow-CN.
  2. Or export the CN env var shown in the message.
  3. Or add api_key under [providers.siliconflow-CN] in ~/.codewhale/config.toml.
  4. Or rely on the fallback: keep api_key in [providers.siliconflow] and omit it from the CN table.

Example fix

# before
provider = "siliconflow-CN"
# no key anywhere

# after
[providers.siliconflow-CN]
api_key = "sk-..."
# or terminal: codewhale auth set --provider siliconflow-CN
Defensive patterns

Strategy: validation

Validate before calling

fn siliconflow_cn_key_present(cfg: &Config) -> bool {
    let cn = cfg.provider_config_for(ApiProvider::SiliconflowCn);
    let fallback = cfg.provider_config_for(ApiProvider::Siliconflow);
    cn.as_ref().and_then(|p| p.api_key.as_ref()).is_some()
        || fallback.and_then(|p| p.api_key).is_some()
        || env_nonempty("SILICONFLOW_CN_API_KEY") || env_nonempty("SILICONFLOW_API_KEY")
        || secret_store_has(ApiProvider::SiliconflowCn)
}

anyhow::ensure!(siliconflow_cn_key_present(&config), "configure siliconflow-CN auth");

Type guard

fn siliconflow_cn_credentials_configured(cfg: &Config) -> bool {
    siliconflow_cn_key_present(cfg)
}

Try / catch

match config.deepseek_api_key() {
    Err(e) if e.to_string().starts_with("SiliconFlow China API key not found") => {
        run_auth_set(ApiProvider::SiliconflowCn)?; // then retry resolution once
        config.deepseek_api_key()
    }
    other => other,
}

Prevention

When it happens

Trigger: provider = siliconflow-CN with none of: auth store key, the CN env var, [providers.siliconflow-CN] api_key, or a fallback [providers.siliconflow] api_key.

Common situations: Users switching between siliconflow and siliconflow-CN assuming credentials are shared; regional accounts with separate keys; missing CN-specific secret in CI.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/f8c402284ac0d8cb. Report an issue: GitHub.