musistudio/claude-code-router · error · Error

${issue.message}

Error message

${issue.message}

What it means

While saving app config, providerApiKeySafetyIssue flagged the provider's primary apiKey/baseUrl combination as unsafe (e.g. key sent to a disallowed host); the issue's message is rethrown verbatim.

Source

Thrown at packages/core/src/config/config.ts:569

      const protocol = parseProviderCapabilityProtocol(
        readString(capability.type) || readString(capability.protocol)
      );
      return Boolean(protocol && protocol !== "openai_chat_completions");
    });
  });
}

function assertProviderApiKeysAreSafe(config: AppConfig): void {
  for (const provider of config.Providers ?? []) {
    const apiKey = providerApiKey(provider);
    const baseUrl = providerBaseUrl(provider);
    const issue = providerApiKeySafetyIssue({
      apiKey,
      baseUrl,
      name: provider.name
    });
    if (issue) {
      throw new Error(issue.message);
    }
    assertProviderAccountApiKeyTargetsAreSafe(provider, apiKey, baseUrl);
    for (const credential of provider.credentials ?? []) {
      const credentialApiKey = providerCredentialApiKey(credential);
      const credentialIssue = providerApiKeySafetyIssue({
        apiKey: credentialApiKey,
        baseUrl,
        name: provider.name
      });
      if (credentialIssue) {
        throw new Error(credentialIssue.message);
      }
      assertProviderCredentialAccountApiKeyTargetsAreSafe(provider, credential, credentialApiKey, baseUrl);
    }
  }
}

function assertProviderAccountApiKeyTargetsAreSafe(provider: GatewayProviderConfig, apiKey: string, baseUrl: string): void {

View on GitHub (pinned to 99f24806c6)

Solutions

1. Read issue.message for the exact policy violation (usually the baseUrl).
2. Change the provider's baseUrl to an allowed endpoint or move the key to the matching provider.
3. Remove/re-enter the offending provider entry.

const issue = providerApiKeySafetyIssue({ apiKey, baseUrl, name });
if (issue) fixProviderBeforeSave(issue);

function providerKeyIsSafe(apiKey: string, baseUrl: string): boolean {
  return !providerApiKeySafetyIssue({ apiKey, baseUrl, name: 'x' });
}

catch (e) { if (/api key|unsafe/i.test((e as Error).message)) showProviderSafetyError(e); }

When it happens

Trigger: saveAppConfigNow → assertProviderApiKeysAreSafe → providerApiKeySafetyIssue returns an issue for the provider's main credential.

Common situations: User points a provider at a custom/localhost/proxy baseUrl that policy forbids, or pastes a key of the wrong provider for the endpoint.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• ${credentialIssue.message}
• ZCode provider API key was not found in ZCode config.
• Invalid theme preference.
• No Bot Gateway conversationRef is configured and no inbound
• The CCR artifact endpoint returned a non-media content type.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/0c2a08f79b101a9b. Report an issue: GitHub.