alibaba/open-code-review · error

API key is required for provider %s (configure it, set provi

Error message

API key is required for provider %s (configure it, set providers.%s.api_key_cmd, or set $%s)

What it means

checkAPIKeyRequirement enforces that an official preset provider has a usable API key before its config is applied. For presets that authenticate via an environment variable (preset.EnvVar, no AmbientAuth), it fails when that env var is unset at config time, telling the user every sanctioned way to supply the key.

Source

Thrown at cmd/opencodereview/provider_cmd.go:252

// api_key_cmd -> env var), so an already-configured command satisfies the
// requirement and picking a model for such a provider does not fail and abandon
// the save. apiKeyCmd is trimmed because the resolver treats a whitespace-only
// command as unset, so without this a command of "   " would satisfy the check
// here and then fail resolution with "no api_key or api_key_cmd configured".
//
// An ambient-auth provider has no credential to save at all: demanding one would
// make it impossible to configure, since the credentials live in the AWS chain
// rather than the config file.
func checkAPIKeyRequirement(providerName, apiKey, apiKeyCmd string, preset llm.Provider, isPreset bool) error {
	if apiKey != "" || strings.TrimSpace(apiKeyCmd) != "" {
		return nil
	}
	switch {
	case isPreset && preset.AmbientAuth:
		return nil
	case isPreset && preset.EnvVar != "":
		if os.Getenv(preset.EnvVar) == "" {
			return fmt.Errorf("API key is required for provider %s (configure it, set providers.%s.api_key_cmd, or set $%s)", providerName, providerName, preset.EnvVar)
		}
		return nil
	default:
		return fmt.Errorf("API key is required for provider %s (configure it or set providers.%s.api_key_cmd)", providerName, providerName)
	}
}

func applyOfficialProviderConfig(configPath string, cfg *Config, result providerTUIResult) error {
	if result.provider == "" {
		return fmt.Errorf("provider and model are required")
	}
	model := result.resolvedModel()
	if model == "" {
		return fmt.Errorf("provider and model are required")
	}

	preset, isPreset := llm.LookupProvider(result.provider)

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Export the preset's env var, e.g. export ANTHROPIC_API_KEY=sk-..., then rerun the config command
2. Configure providers.<name>.api_key_cmd in the config so the key is fetched from a secret manager at runtime
3. Enter the API key in the provider wizard when prompted
4. Check that the env var is visible to the ocr process (same shell/session, not just .bashrc)

Example fix

// before (shell)
ocr config provider   # fails: ANTHROPIC_API_KEY unset
// after
export ANTHROPIC_API_KEY=sk-ant-...
ocr config provider

preset, isPreset := llm.LookupProvider(name)
if isPreset && !preset.AmbientAuth && preset.EnvVar != "" && os.Getenv(preset.EnvVar) == "" {
    // prompt for key or set providers.<name>.api_key_cmd before running config
}

if err := run(); err != nil && strings.Contains(err.Error(), "API key is required for provider") {
    fmt.Fprintf(os.Stderr, "export %s first or configure api_key_cmd\n", presetEnvVar)
    os.Exit(1)
}

When it happens

Trigger: Applying an official provider whose preset declares EnvVar (e.g. ANTHROPIC_API_KEY) while os.Getenv(preset.EnvVar) returns "" and no api_key/api_key_cmd satisfies the check.

Common situations: Fresh machine or CI container where the vendor env var was never exported; env var set in an interactive shell but not in the environment of the ocr process; typo'd env var name; key stored only in a config file field the check does not consult.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• API key is required for provider %s (configure it or set pro
• custom provider %q not found
• resolve LLM endpoint: %w
• provider name is required
• model is required

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/9a79ca590ed2df62. Report an issue: GitHub.