Hmbown/CodeWhale · error

unavailable credential

Error message

unavailable credential

What it means

`codewhale auth print-api-key` writes the runtime-effective API key to a piped stdout for a local client. Any resolution failure is deliberately flattened to "unavailable credential" so the credential channel carries no diagnostics an unintended reader could exploit. Real causes include: resolved provider differs from requested, OAuth bearer credentials where an API key is required (codex/xai/moonshot token modes), no runtime-effective key at all, or a whitespace-only key.

Source

Thrown at crates/cli/src/credential_handoff.rs:65

                .auth_mode
                .as_deref()
                .is_some_and(auth_mode_uses_kimi_imported_token);
        ensure!(!kimi_bearer, "bearer credentials are not an API key");
    }
    ensure!(source.is_some(), "no runtime-effective API key");
    resolved
        .api_key
        .filter(|value| !value.trim().is_empty())
        .context("no usable runtime-effective API key")
}

pub(crate) fn handoff_secret_line(
    writer: &mut impl Write,
    stdout_is_terminal: bool,
    resolve: impl FnOnce() -> Result<String>,
) -> Result<()> {
    prepare_stdout(stdout_is_terminal)?;
    let secret = Zeroizing::new(resolve().map_err(|_| anyhow::anyhow!("unavailable credential"))?);
    ensure!(!secret.trim().is_empty(), "credential handoff was empty");
    let written = writeln!(writer, "{}", secret.as_str());
    if written.is_ok() || written.is_err_and(|error| error.kind() == ErrorKind::BrokenPipe) {
        return Ok(());
    }
    bail!("credential handoff could not write to stdout")
}
#[cfg(test)]
mod tests;

View on GitHub (pinned to 8880682c63)

Solutions

1. Run the same command's diagnostics outside a pipe (`codewhale doctor`, or any non-handoff command) to see the real reason
2. If the account uses OAuth bearer credentials, configure a plain API key instead (--api-key or provider key login)
3. Ensure the requested provider matches the configured one
4. Scripts should detect this exact message on stderr and fall back to prompting, not retry

key=$(codewhale auth print-api-key --provider openai 2>err.txt)
if [ -z "$key" ]; then
  if grep -q "unavailable credential" err.txt; then
    # resolution failed and the reason is redacted from the pipe — diagnose unpiped:
    codewhale doctor
    exit 1
  fi
fi

When it happens

Trigger: Piping `codewhale auth print-api-key` when the account uses OAuth bearer auth instead of an API key, when --provider does not match the configured provider, or when no key is configured anywhere (config, secret store, env).

Common situations: Wrapper scripts assuming a plain API key exists after cloud login; xAI/Codex/Moonshot accounts authenticated with OAuth tokens; provider override flags mismatching the stored configuration.

Related errors

• unavailable credential
• parallel(): expected an array of thunks
• Could not inspect GitHub Release ${tag}: ${detail}
• No local {} API key was found in config, the secret store, o
• Codewhale account API base URL must include a host

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/ab24a4e792843d42. Report an issue: GitHub.