{"record":{"id":"7280aabc3bfd26f0","repo":"Hmbown/CodeWhale","slug":"no-local-api-key-was-found-in-config-the-secre","errorCode":null,"errorMessage":"No local {} API key was found in config, the secret store, or the environment","messagePattern":"No local (.+?) API key was found in config, the secret store, or the environment","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/cloud.rs","lineNumber":648,"sourceCode":"        CloudCommand::Keys(keys) => match keys.command {\n            CloudKeysCommand::List => {\n                let user = client.me()?;\n                write_account(out, \"Codewhale account keys.\", profile, api_base, &user)?;\n                for provider in CloudProvider::ALL {\n                    let state = user.model_keys.get(provider.slug());\n                    if state.is_some_and(|state| state.configured) {\n                        writeln!(out, \"{}: set\", provider.slug())?;\n                    } else {\n                        writeln!(out, \"{}: not set\", provider.slug())?;\n                    }\n                }\n                Ok(())\n            }\n            CloudKeysCommand::Set(set) => {\n                let user = client.me()?;\n                let key = if set.from_local {\n                    resolve_local_key(config, provider_secrets, set.provider)?.ok_or_else(|| {\n                        anyhow!(\n                            \"No local {} API key was found in config, the secret store, or the environment\",\n                            set.provider.slug()\n                        )\n                    })?\n                } else if set.api_key_stdin {\n                    key_reader(KeyReadMode::Stdin)?\n                } else {\n                    key_reader(KeyReadMode::HiddenPrompt(set.provider.slug().to_string()))?\n                };\n                let key = key.trim().to_string();\n                validate_api_key(&key)?;\n                let label = validate_label(&set.label)?;\n                client.set_key(set.provider, &key, &label)?;\n                writeln!(\n                    out,\n                    \"Saved {} for Codewhale account {} (profile {}).\",\n                    set.provider.slug(),\n                    printable(&user.id),","sourceCodeStart":630,"sourceCodeEnd":666,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/cli/src/cloud.rs#L630-L666","documentation":"Thrown by `codewhale cloud keys set <provider> --from-local`. resolve_local_key searches, in order: the provider config entry (providers.<kind>.api_key, resolving $VAR references; Deepseek also falls back to the top-level api_key), the local secret-store slot named for the provider kind, and the provider's environment variables. When every source is absent or whitespace-empty, there is nothing to upload and this error is returned.","triggerScenarios":"Running `cloud keys set <provider> --from-local` on a machine where the provider was never configured: no config key, no secret-store entry, and no provider env var (e.g. OPENAI_API_KEY) set. Also when a $VAR config reference points at an unset variable, or the env var is set but empty.","commonSituations":"Fresh machine or container trying to migrate a key that only exists on a dev workstation; key stored under a different provider than the cloud provider's local_kind maps to; CI job that never injects the env var.","solutions":["Skip --from-local and supply the key directly: `codewhale cloud keys set <provider> --api-key-stdin` (or the hidden prompt)","Export the provider's env var (e.g. OPENAI_API_KEY=sk-...) in the shell and rerun the same command","Configure the key locally first (provider auth / api-key set) so the secret store has a value, then rerun --from-local","Verify sources with `codewhale cloud keys status` and by inspecting the providers section of the config"],"exampleFix":"# before\n codewhale cloud keys set openai --from-local   # error: no local key\n\n# after\n export OPENAI_API_KEY=sk-... \n codewhale cloud keys set openai --from-local \n # or: printf '%s' \"$KEY\" | codewhale cloud keys set openai --api-key-stdin","handlingStrategy":"validation","validationCode":"# Verify a local key exists before attempting --from-local:\n codewhale cloud keys status | grep -q \"$(slug): set\" \\\n   || export -n OPENAI_API_KEY 2>/dev/null \\\n   || [ -n \"${OPENAI_API_KEY:-}\" ] \\\n   || { echo \"no local key; using stdin\"; printf '%s' \"$KEY\" | codewhale cloud keys set openai --api-key-stdin; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["In scripts, prefer --api-key-stdin over --from-local so behavior does not depend on machine state","Run `codewhale cloud keys status` first to confirm which providers have local keys","Remember Deepseek reads the top-level config api_key while others read providers.<kind>.api_key","Trim env vars; whitespace-only values count as absent"],"tags":["cli","cloud","api-key","secrets","environment","rust"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}