charmbracelet/crush · error

invalid API key format for provider %s

Error message

invalid API key format for provider %s

What it means

Returned by the API-key validation routine in internal/config/config.go for the Alibaba (Singapore) inference provider. Alibaba exposes no endpoint to validate keys, so Crush performs an offline pattern check: the key must start with "sk-". A key failing this prefix check means it was copied incorrectly or belongs to a different provider.

Source

Thrown at internal/config/config.go:961

}

func (c *ProviderConfig) TestConnection(resolver VariableResolver) error {
	var (
		providerID = catwalk.InferenceProvider(c.ID)
		testURL    = ""
		headers    = make(map[string]string)
		apiKey, _  = resolver.ResolveValue(c.APIKey)
	)

	switch providerID {
	case catwalk.InferenceProviderMiniMax, catwalk.InferenceProviderMiniMaxChina:
		// NOTE: MiniMax has no good endpoint we can use to validate the API key.
		return nil
	case catwalk.InferenceProviderAlibabaSingapore:
		// NOTE: Alibaba has no good endpoint we can use to validate the API key.
		// Let's at least check the pattern.
		if !strings.HasPrefix(apiKey, "sk-") {
			return fmt.Errorf("invalid API key format for provider %s", c.ID)
		}
		return nil
	}

	switch c.Type {
	case catwalk.TypeOpenAI, catwalk.TypeOpenAICompat, catwalk.TypeOpenRouter:
		baseURL, _ := resolver.ResolveValue(c.BaseURL)
		baseURL = cmp.Or(baseURL, "https://api.openai.com/v1")

		switch providerID {
		case catwalk.InferenceProviderOpenRouter:
			testURL = baseURL + "/credits"
		case catwalk.InferenceProviderOpenCodeGo:
			testURL = strings.Replace(baseURL, "/go", "", 1) + "/models"
		default:
			testURL = baseURL + "/models"
		}

View on GitHub (pinned to 7944b8e522)

Solutions

1. Re-copy the API key from the Alibaba DashScope console, ensuring it starts with "sk-".
2. Verify the key belongs to the Alibaba Singapore endpoint you configured.
3. Strip surrounding quotes/whitespace when pasting the key into crushrc or the prompt.
4. If you believe the key is valid, bypass pattern validation expectations by confirming the provider ID matches the key's region.

Example fix

// before
c.ID = "alibaba"
apiKey = "a1b2c3d4" // missing sk- prefix
// after
apiKey = "sk-a1b2c3d4eff5..." // full key copied from DashScope console

if provider == "alibaba" && !strings.HasPrefix(apiKey, "sk-") {
    return errors.New("alibaba API keys must start with sk-; re-copy from DashScope console")
}

func isValidAlibabaKey(key string) bool {
    return strings.HasPrefix(strings.TrimSpace(key), "sk-")
}

if err := cfg.ValidateAPIKeys(ctx); err != nil {
    if strings.Contains(err.Error(), "invalid API key format") {
        promptUserToReenterKey()
        return nil // retry after correction
    }
    return err
}

When it happens

Trigger: Calling provider API-key validation (e.g. during config setup or `crush models`/login flows) with InferenceProviderAlibabaSingapore whose apiKey does not begin with "sk-".

Common situations: Pasting a DashScope key without its "sk-" prefix; using an Alibaba international key on the Singapore endpoint or vice versa; accidentally using a key from another provider (OpenAI-style keys differ); trailing whitespace trimming the prefix visually but a different string entirely.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• not a valid bedrock api key
• not a valid vercel api key
• mcp stdio config requires a non-empty 'command' field
• mcp http config requires a non-empty 'url' field
• mcp sse config requires a non-empty 'url' field

AI-assisted analysis of charmbracelet/crush@7944b8e522 (2026-08-29). Data as JSON: /api/errors/f9abd2eab1184704. Report an issue: GitHub.