{"record":{"id":"9bcd168a9c1d7a3f","repo":"Hmbown/CodeWhale","slug":"kimi-cli-credential-import-is-unsupported-codewha","errorCode":null,"errorMessage":"Kimi CLI credential import is unsupported. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from {} instead.","messagePattern":"Kimi CLI credential import is unsupported\\. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from (.+?) instead\\.","errorType":"console","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/config.rs","lineNumber":6146,"sourceCode":"        }\n        if matches!(provider, ApiProvider::Deepseek | ApiProvider::DeepseekCN)\n            && self.config_credentials_are_bound_to_provider_endpoint(provider)\n            && let Some(configured) = self.api_key.as_ref()\n            && classify_config_api_key_value(configured) == ConfigApiKeyValueKind::Literal\n        {\n            warn_on_config_api_key_shadowing(self, provider, \"the root api_key\");\n            return Ok(configured.clone());\n        }\n\n        if provider == ApiProvider::Moonshot\n            && !custom_endpoint\n            && self\n                .provider_config_for(provider)\n                .is_some_and(provider_config_uses_kimi_imported_token)\n        {\n            let credential_help =\n                credential_help_for_provider_route(provider, &self.deepseek_base_url());\n            anyhow::bail!(\n                \"Kimi CLI credential import is unsupported. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from {} instead.\",\n                credential_help\n                    .credential_url\n                    .unwrap_or(\"the selected provider's API-key console\")\n            );\n        }\n\n        // xAI OAuth prefers Codewhale-owned device-login storage. An existing\n        // Grok CLI file is considered only with provider/path-scoped read-only\n        // consent. Activated by [providers.xai] auth_mode = \"oauth\".\n        if provider == ApiProvider::Xai\n            && !custom_endpoint\n            && self\n                .provider_config_for(provider)\n                .is_some_and(provider_config_uses_xai_oauth)\n            && crate::xai_oauth::credentials_present(self)\n        {\n            return crate::xai_oauth::get_access_token(self);","sourceCodeStart":6128,"sourceCodeEnd":6164,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/tui/src/config.rs#L6128-L6164","documentation":"In the provider key-resolution chain, Moonshot with the stock endpoint rejects configs whose [providers.moonshot] auth_mode selects a Kimi-CLI-imported OAuth token (provider_config_uses_kimi_imported_token). Codewhale deliberately does not impersonate Kimi's OAuth client, so the imported-token route is unsupported and fails loudly instead of silently degrading.","triggerScenarios":"A config carried over from Kimi CLI import support with auth_mode set to a kimi-imported-token mode; provider = moonshot without a custom endpoint; no API key configured anywhere.","commonSituations":"Downgrading or migrating from a Kimi CLI setup; following an old guide that told users to import Kimi CLI tokens; sharing configs between tools that did support token import.","solutions":["Configure a Moonshot API key instead: codewhale auth set --provider moonshot.","Remove the imported-token auth_mode from [providers.moonshot] (delete auth_mode or replace with api_key auth).","If you have a Kimi Code membership plan, set [providers.moonshot] base_url = \"https://api.kimi.com/coding/v1\" and use a plan key."],"exampleFix":"# before\n[providers.moonshot]\nauth_mode = \"kimi-imported-token\"\n\n# after\n[providers.moonshot]\napi_key = \"sk-...\"   # or: codewhale auth set --provider moonshot","handlingStrategy":"validation","validationCode":"// reject Moonshot configs that still select Kimi token import before resolving keys\nif config.provider_config_for(ApiProvider::Moonshot)\n    .map(|pc| pc.auth_mode.as_deref().is_some_and(auth_mode_uses_kimi_imported_token))\n    .unwrap_or(false)\n{\n    anyhow::bail!(\"this config predates support: switch [providers.moonshot] to api_key auth\");\n}","typeGuard":"fn moonshot_config_is_supported(pc: &ProviderConfig) -> bool {\n    !pc.auth_mode\n        .as_deref()\n        .is_some_and(auth_mode_uses_kimi_imported_token)\n}","tryCatchPattern":"match config.deepseek_api_key() {\n    Err(e) if e.to_string().contains(\"Kimi CLI credential import is unsupported\") => {\n        // strip the imported-token auth_mode, then guide to codewhale auth set --provider moonshot\n        Err(e)\n    }\n    other => other,\n}","preventionTips":["Do not follow old guides that import Kimi CLI OAuth tokens — they are unsupported by design.","Prefer `codewhale auth set --provider moonshot` over any token-file scheme.","Audit configs after upgrades for removed auth_mode values."],"tags":["rust","moonshot","kimi","oauth","credentials","config"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}