{"record":{"id":"d381f9d9090e95e1","repo":"alibaba/open-code-review","slug":"api-key-is-required-for-provider-s-configure-it-d381f9","errorCode":null,"errorMessage":"API key is required for provider %s (configure it or set providers.%s.api_key_cmd)","messagePattern":"API key is required for provider (.+?) \\(configure it or set providers\\.(.+?)\\.api_key_cmd\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/opencodereview/provider_cmd.go","lineNumber":256,"sourceCode":"// here and then fail resolution with \"no api_key or api_key_cmd configured\".\n//\n// An ambient-auth provider has no credential to save at all: demanding one would\n// make it impossible to configure, since the credentials live in the AWS chain\n// rather than the config file.\nfunc checkAPIKeyRequirement(providerName, apiKey, apiKeyCmd string, preset llm.Provider, isPreset bool) error {\n\tif apiKey != \"\" || strings.TrimSpace(apiKeyCmd) != \"\" {\n\t\treturn nil\n\t}\n\tswitch {\n\tcase isPreset && preset.AmbientAuth:\n\t\treturn nil\n\tcase isPreset && preset.EnvVar != \"\":\n\t\tif os.Getenv(preset.EnvVar) == \"\" {\n\t\t\treturn fmt.Errorf(\"API key is required for provider %s (configure it, set providers.%s.api_key_cmd, or set $%s)\", providerName, providerName, preset.EnvVar)\n\t\t}\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"API key is required for provider %s (configure it or set providers.%s.api_key_cmd)\", providerName, providerName)\n\t}\n}\n\nfunc applyOfficialProviderConfig(configPath string, cfg *Config, result providerTUIResult) error {\n\tif result.provider == \"\" {\n\t\treturn fmt.Errorf(\"provider and model are required\")\n\t}\n\tmodel := result.resolvedModel()\n\tif model == \"\" {\n\t\treturn fmt.Errorf(\"provider and model are required\")\n\t}\n\n\tpreset, isPreset := llm.LookupProvider(result.provider)\n\n\tif err := checkAPIKeyRequirement(result.provider, result.apiKey, cfg.Providers[result.provider].APIKeyCmd, preset, isPreset); err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/cmd/opencodereview/provider_cmd.go#L238-L274","documentation":"The default branch of checkAPIKeyRequirement handles providers that are not ambient-auth presets and have no env-var preset: no API key source could be determined, so config application is refused with guidance to configure the key directly or via providers.<name>.api_key_cmd.","triggerScenarios":"checkAPIKeyRequirement is called for a provider that either is not a known preset, or is a preset with AmbientAuth=false and empty EnvVar, while result.apiKey is empty and cfg.Providers[name].APIKeyCmd is also empty.","commonSituations":"Self-hosted or gateway providers not in the preset registry; a misspelled provider name so LookupProvider fails and isPreset is false; existing config entry lacking api_key_cmd after upgrading; wizard completed with the key field left blank.","solutions":["Provide the API key in the wizard (result.apiKey) when running 'ocr config provider'","Set providers.<name>.api_key_cmd in the config file to a command that prints the key","Check the provider name spelling so it matches a preset in llm.LookupProvider (presets may support env vars)"],"exampleFix":"// before (config.toml)\n[providers.my-gateway]\n# no api_key, no api_key_cmd\n// after\n[providers.my-gateway]\napi_key_cmd = [\"op\", \"read\", \"op://vault/gateway-key\"]","handlingStrategy":"validation","validationCode":"if result.apiKey == \"\" && cfg.Providers[name].APIKeyCmd == \"\" {\n    // supply key in wizard or set api_key_cmd before applying\n}","typeGuard":null,"tryCatchPattern":"if err := applyOfficialProviderConfig(path, cfg, result); err != nil && strings.Contains(err.Error(), \"API key is required\") {\n    // prompt for the key or configure api_key_cmd and retry once\n}","preventionTips":["Fill the API key field when the wizard prompts for non-preset providers","Set providers.<name>.api_key_cmd for keyless shell environments","Verify provider spelling so preset env-var support applies"],"tags":["config","api-key","provider","validation"],"backgroundTag":"missing-api-key","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}