[Bug]: Re-authenticating in Windows Desktop appears to remove existing API keys

Abierto
  • ¿Algo no está bien?
#154 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
shell
Área
authentication, backend-api-design

Línea de trabajo

Start by tracing the Desktop re-authentication flow and the server-side API key management endpoint mentioned in the report. Compare the key set before and after sign-in, and check whether keys were deleted, revoked, or only hidden in Studio. Done means identifying the cause and confirming that re-authentication preserves unrelated keys or documenting the intended behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
GUI version

0.1.60

Operating system

Windows

Reproduction steps

Summary

I use Command Code Desktop on Windows with the built-in BYOK provider feature supported by Desktop.

Before the most recent sign-in, the API Keys page in Command Code Studio showed multiple existing API keys. These included keys I had created manually, as well as keys associated with previous Desktop sign-ins.

I did not manually delete or revoke any of these keys.

Recently, Command Code Desktop unexpectedly prompted me to sign in again. After completing the sign-in flow, I checked the API Keys page in Studio and found that all previously listed keys were gone. Only one key remained: the key created during the latest Desktop sign-in.

I regularly use Command Code across multiple devices, so I need existing API keys to remain available unless I explicitly revoke them.

This makes me concerned that the Desktop sign-in or re-authentication flow may be unintentionally deleting, revoking, or resetting existing API keys.

Expected behavior

Signing in or re-authenticating in Desktop should not silently delete existing API keys.

Manually created API keys and keys used by other devices should remain available unless explicitly revoked by the user.

If the sign-in flow is intended to create or rotate a key, it should not unexpectedly remove unrelated existing keys.

Any operation that deletes or revokes existing keys should require explicit user confirmation and be clearly documented.

Actual behavior

Desktop unexpectedly requested that I sign in again.

I completed the sign-in process.

I opened the API Keys page in Command Code Studio.

All previously existing API keys were no longer listed.

Only one API key remained, apparently the one created during the latest Desktop sign-in.

I did not intentionally delete or revoke any keys.

Screenshots, recordings, or sanitized logs

Steps to Reproduce

Sign in to Command Code Desktop on Windows.

Use the built-in BYOK provider feature supported by Desktop.

Have multiple API keys present in the API Keys page in Command Code Studio, including manually created keys.

At a later time, when Desktop prompts you to sign in again, complete the sign-in flow.

Reopen or refresh the API Keys page in Studio.

Check whether the previously existing API keys are still listed.

I observed this behavior after a new sign-in. I have not yet established whether the issue is consistently reproducible.

Environment

Application: Command Code Desktop

Version: 0.1.60

Operating System: Windows

Feature in use: Built-in BYOK provider support

Usage pattern: Multiple devices using the same Command Code account

Trigger observed: Desktop prompted me to sign in again

Questions for the Maintainers

Can the Desktop sign-in or re-authentication flow create, delete, revoke, or reset API keys associated with the user's Studio account?

Is the disappearance of previously existing API keys an expected behavior or a bug?

Could the sign-in flow be unintentionally replacing the existing API key set with a newly generated key?

Is there an audit log or another way to determine whether the old keys were deleted, revoked, or merely stopped appearing in the UI?

Please investigate whether the Desktop authentication flow or the related server-side API key management endpoint can cause this behavior.

Thank you.

Safety check
  • I removed credentials and private project information from this report.
Lenguaje dominante
Shell
Estrellas
110
Forks
9
Merge medio
12 min
PR fusionados (30 d)
1

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de CommandCodeAI/desktop

Todos los issues de CommandCodeAI/desktop

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.