Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[bug] request Authorization header uses root-level api_key instead of active profile key; config show disagrees with the wire; config edits have no effect

Ouverte
  • Quelque chose ne va pas ?
#264 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
1-2 jours
Accessibilité débutants
48/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
typescript
Domaine
authentication, cli

Piste de recherche

Start by tracing how the CLI selects credentials for requests and how bl config show resolves the active profile; the report does not name source files or tests. Reproduce with a profile base_url and api_key, then compare the verbose Authorization mask against the active profile key. Done when requests use the active profile's key and the config view matches the key sent.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

bug
CLI version

2.3.1

Skill version (optional)

2.3.1

Node version

n/a (standalone binary install channel, no Node on machine)

OS

Windows 10 10.0.19045 x86_64 (MINGW64/Git Bash)

Region

cn

Command to reproduce
bl video task get --task-id 00000000-0000-0000-0000-000000000000 --verbose
Expected behavior

The Authorization header should match the active profile's api_key — the same key bl config show reports as active — so the request authenticates against the profile's base_url.

Actual behavior
  • The > Auth: mask printed by --verbose matches the ROOT-level api_key [REDACTED root-level key], while the request URL is the PROFILE's base_url (token-plan regional endpoint) → HTTP 401 InvalidApiKey (request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883, a79cdf7b-a2d0-40ed-9e51-59a2daa02c6e).
  • bl config show reports the PROFILE key [REDACTED profile key] as active — the CLI's own config view contradicts what is sent on the wire.
  • Removing the root-level api_key from config.json does NOT change the key sent on the wire (same root-key mask on the next request) → suggests a credential store outside config.json silently takes precedence.
  • Explicit --config <profile> does not change the sent key either.
  • Control experiments: root key + root base_url → HTTP 200; profile endpoint + explicitly passed valid profile key → HTTP 200. Only the mixed pairing (root key + profile endpoint) fails — which is what the CLI produces by itself.
  • Reproduced on both 1.27.0 and 2.3.1 (on 2.3.1 the wrong Auth header is visible in --verbose before the unrelated HTTP crash of #263).
Full output
> GET https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/tasks/00000000-0000-0000-0000-000000000000
> Auth: [REDACTED root-level key]
> x-dashscope-source-config: {"channel":"bailian-cli","tags":{"t1":"public","t2":"bl","t3":"1.27.0"}}
< 401 Unauthorized
request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883

Error:       Invalid API-key provided.
Status:      HTTP 401 (InvalidApiKey)
Exit code:   1
JSON error (optional)
Already tried
  • bl update and skill version aligned with CLI
  • bl auth status OK for this command
  • Different network / region — still reproduces
How often does this happen?

Always

How was bl invoked?

Agent (Cursor, Claude, etc.)

Notes (optional)
  • Related: #171 (closed) covered 401s for the upload-policy endpoint under token-plan profiles; this report is about the broader credential precedence/mixing affecting every request.
  • Security/UX concern: a key the user can no longer see or edit in config.json keeps being used; there is no documented way to inspect or clear that external credential store via bl.
  • Attribution: automatically drafted and submitted by the agentic assistant (model: qwen3.8-max) of Qoder CN Desktop v0.4.3 (build 0.4.3.0) on behalf of the account owner, who reviewed and approved the content before submission.
Langage dominant
TypeScript
Étoiles
475
Forks
34
Merge moyen
19 h 34 min
PR mergées (30 j)
34

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de modelstudioai/cli

Toutes les issues de modelstudioai/cli

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.