{"record":{"id":"9bcd168a9c1d7a3f","repo":"Hmbown/CodeWhale","slug":"kimi-cli-credential-import-is-unsupported-codewha","errorCode":null,"errorMessage":"Kimi CLI credential import is unsupported. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from {} instead.","messagePattern":"Kimi CLI credential import is unsupported\\. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from (.+?) instead\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/config.rs","lineNumber":7136,"sourceCode":"        }\n        if matches!(provider, ApiProvider::Deepseek | ApiProvider::DeepseekCN)\n            && self.config_credentials_are_bound_to_provider_endpoint(provider)\n            && let Some(configured) = self.api_key.as_ref()\n            && classify_config_api_key_value(configured) == ConfigApiKeyValueKind::Literal\n        {\n            warn_on_config_api_key_shadowing(self, provider, \"the root api_key\");\n            return Ok(configured.clone());\n        }\n\n        if provider == ApiProvider::Moonshot\n            && !custom_endpoint\n            && self\n                .provider_config_for(provider)\n                .is_some_and(provider_config_uses_kimi_imported_token)\n        {\n            let credential_help =\n                credential_help_for_provider_route(provider, &self.active_route_base_url());\n            anyhow::bail!(\n                \"Kimi CLI credential import is unsupported. Codewhale does not impersonate or reuse Kimi OAuth clients; configure an API key from {} instead.\",\n                credential_help\n                    .credential_url\n                    .unwrap_or(\"the selected provider's API-key console\")\n            );\n        }\n\n        // xAI OAuth prefers Codewhale-owned device-login storage. An existing\n        // Grok CLI file is considered only with provider/path-scoped read-only\n        // consent. Activated by [providers.xai] auth_mode = \"oauth\".\n        if provider == ApiProvider::Xai\n            && !custom_endpoint\n            && self\n                .provider_config_for(provider)\n                .is_some_and(provider_config_uses_xai_oauth)\n            && crate::oauth::credentials_present(crate::oauth::OAuthProvider::Xai, self)\n        {\n            return crate::oauth::get_xai_access_token(self);","sourceCodeStart":7118,"sourceCodeEnd":7154,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/config.rs#L7118-L7154","documentation":"Codewhale refuses to route requests through Kimi CLI imported OAuth tokens. The library deliberately does not impersonate or reuse the Kimi CLI's OAuth client, so if the active provider route is configured to use an imported Kimi token, configuration resolution fails fast before any request is sent, pointing the user at the provider's API-key console instead.","triggerScenarios":"The active provider route's provider config satisfies provider_config_uses_kimi_imported_token (e.g. [providers.moonshot] configured to import the Kimi CLI token) and any API call resolves credentials through Config::active_route_api_key.","commonSituations":"A user who previously authenticated with Kimi CLI copies that setup into their codewhale config expecting SSO to carry over; CI or dotfiles migrate a Kimi CLI credential import left over from an older codewhale version that tolerated it.","solutions":["Remove the Kimi CLI credential import / imported-token auth_mode from the provider route config.","Create a Kimi (Moonshot) API key at the console URL shown in the error and set [providers.<route>] api_key or api_key_env.","Run 'codewhale auth set --provider moonshot' to store the key.","For Kimi Code plans, set [providers.moonshot] base_url = \"https://api.kimi.com/coding/v1\" and model = \"kimi-for-coding\" with a plan API key."],"exampleFix":"// before\n[providers.moonshot]\nauth_mode = \"kimi-cli-import\"\n\n// after\n[providers.moonshot]\napi_key = \"sk-...\"","handlingStrategy":"validation","validationCode":"fn uses_kimi_import(cfg: &toml::Value) -> bool {\n    cfg.get(\"providers\").and_then(|p| p.get(\"moonshot\"))\n        .and_then(|m| m.get(\"auth_mode\"))\n        .and_then(|a| a.as_str())\n        .map(|s| s.contains(\"kimi-cli-import\"))\n        .unwrap_or(false)\n}\nif uses_kimi_import(load_config()) {\n    eprintln!(\"replace the kimi CLI import with api_key before starting\");\n}","typeGuard":"fn has_static_key(cfg: &ProviderCfg) -> bool {\n    cfg.api_key.as_deref().map(|k| !k.trim().is_empty()).unwrap_or(false)\n        || cfg.api_key_env.as_deref().map(|e| !e.trim().is_empty()).unwrap_or(false)\n}","tryCatchPattern":null,"preventionTips":["Never configure Kimi CLI OAuth import; Codewhale does not reuse third-party OAuth clients.","Provision a real API key per provider route before enabling it.","Keep provider credentials as api_key/api_key_env, not imported tokens."],"tags":["config","oauth","kimi","credentials"],"backgroundTag":"missing-api-key","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}