{"record":{"id":"4f3a5abc71864834","repo":"Hmbown/CodeWhale","slug":"oauth-bearer-credentials-are-not-an-api-key","errorCode":null,"errorMessage":"OAuth bearer credentials are not an API key","messagePattern":"OAuth bearer credentials are not an API key","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/cli/src/credential_handoff.rs","lineNumber":44,"sourceCode":"    secrets: &Secrets,\n    provider: ProviderKind,\n    runtime_overrides: &CliRuntimeOverrides,\n) -> Result<String> {\n    let resolved = store.config.resolve_runtime_options_with_secrets(\n        &runtime_overrides_for_provider(runtime_overrides, provider),\n        secrets,\n    );\n    if resolved.provider != provider {\n        bail!(\"resolved a different provider\");\n    }\n    let source = resolved.api_key_source;\n    if source != Some(RuntimeApiKeySource::Cli) {\n        if provider == ProviderKind::OpenaiCodex {\n            bail!(\"bearer credentials are not an API key\");\n        }\n        let uses_api_key = provider != ProviderKind::Xai\n            || xai_auth_diagnostics(store, runtime_overrides).evaluates_runtime_api_key();\n        ensure!(uses_api_key, \"OAuth bearer credentials are not an API key\");\n        let kimi_bearer = provider == ProviderKind::Moonshot\n            && resolved\n                .auth_mode\n                .as_deref()\n                .is_some_and(auth_mode_uses_kimi_imported_token);\n        ensure!(!kimi_bearer, \"bearer credentials are not an API key\");\n    }\n    ensure!(source.is_some(), \"no runtime-effective API key\");\n    resolved\n        .api_key\n        .filter(|value| !value.trim().is_empty())\n        .context(\"no usable runtime-effective API key\")\n}\n\npub(crate) fn handoff_secret_line(\n    writer: &mut impl Write,\n    stdout_is_terminal: bool,\n    resolve: impl FnOnce() -> Result<String>,","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/cli/src/credential_handoff.rs#L26-L62","documentation":"Resolved-provider guard in resolve_api_key: after resolving runtime options with secrets, the active provider differs from the requested provider kind. The handoff must only emit a credential for the provider actually in effect, so a mismatch is rejected.","triggerScenarios":"Thrown at crates/cli/src/credential_handoff.rs:44 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Align the requested provider with the currently configured/resolved runtime provider.","Remove or correct runtime overrides that redirect resolution to another provider.","Update config so the intended provider is the one actually active."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}