plandex-ai/plandex · error

error checking API keys/credentials: %v

Error message

error checking API keys/credentials: %v

What it means

CheckCredentialStatus resolves auth variables per provider and grades each provider's credentials. This error wraps a failure from ResolveProviderAuthVars (line 67) — i.e. credentials could not even be resolved (bad account-credential store or unreadable credential file) — before any status grading happens.

Source

Thrown at app/cli/lib/model_credentials.go:67

func CheckCredentialStatus(opts shared.ModelProviderOptions, claudeMaxEnabled bool) (CredentialCheckResult, error) {
	publishersToProviders := groupProvidersByPublisher(opts)

	selectedAuthVars := map[string]string{}
	var publisherStatuses []PublisherCredentialStatus
	allSatisfied := true

	for publisher, providers := range publishersToProviders {
		var selectedProvider *ProviderCredentialStatus
		partialProviders := []ProviderCredentialStatus{}

		for _, provider := range providers {
			if provider.Config.HasClaudeMaxAuth && !claudeMaxEnabled {
				continue
			}

			authVars, err := ResolveProviderAuthVars(provider.Config)
			if err != nil {
				return CredentialCheckResult{}, fmt.Errorf("error checking API keys/credentials: %v", err)
			}
			status, missingVars, err := checkProviderCredentialStatus(provider.Config, authVars)
			if err != nil {
				return CredentialCheckResult{}, fmt.Errorf("error checking API keys/credentials: %v", err)
			}

			providerStatus := ProviderCredentialStatus{
				ProviderComposite: provider.Config.ToComposite(),
				Status:            status,
				MissingVars:       missingVars,
			}

			if status == FullySatisfied {
				selectedProvider = &providerStatus
				mergeAuthVars(selectedAuthVars, authVars)
				break // first fully satisfied provider found, stop looking further
			} else if status == PartiallySatisfied {
				partialProviders = append(partialProviders, providerStatus)

View on GitHub (pinned to e2d772072e)

Solutions

1. Read the wrapped %v cause to identify the failing provider and sub-error.
2. If it is a file-load failure, verify the credential file path in the env var exists and is readable.
3. If it is account credentials, re-authenticate / regenerate the local credentials store.
4. Temporarily disable the offending provider config (or set SkipAuth) to confirm which provider breaks the check.

Example fix

// before
res, err := CheckCredentialStatus(opts, claudeMaxEnabled)
if err != nil { log.Fatal(err) }
// after
res, err := CheckCredentialStatus(opts, claudeMaxEnabled)
if err != nil {
    log.Printf("credential check failed: %v", err) // inspect wrapped cause
    return err
}

func credentialFilesExist(cfgs []*shared.ModelProviderConfigSchema) error {
    for _, c := range cfgs {
        for _, v := range c.ExtraAuthVars {
            if v.MaybeJSONFilePath {
                p := os.Getenv(v.Var)
                if p != "" && !strings.HasPrefix(p, "{") {
                    if _, err := os.Stat(p); err != nil { return fmt.Errorf("%s: %w", v.Var, err) }
                }
            }
        }
    }
    return nil
}

res, err := CheckCredentialStatus(opts, claudeMaxEnabled)
if err != nil {
    if strings.Contains(err.Error(), "failed to load file for") {
        log.Printf("fix credential file path: %v", err)
    }
    return err
}

When it happens

Trigger: Calling CheckCredentialStatus(opts, claudeMaxEnabled) when ResolveProviderAuthVars returns an error for some provider: GetAccountCredentials fails for a HasClaudeMaxAuth provider, or a MaybeJSONFilePath ExtraAuthVar points to an unreadable file.

Common situations: Corrupt or locked local credentials store, GOOGLE_APPLICATION_CREDENTIALS-style var pointing at a deleted/moved JSON key file, or a provider marked ClaudeMax-auth while the credentials file is inaccessible.

Related errors

• error loading accounts: %v
• error getting account credentials: %v
• failed to load file for %s: %v
• failed to load AWS config: %v
• error signing in to new account: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/ab4218b277616373. Report an issue: GitHub.