Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[bug] request Authorization header uses root-level api_key instead of active profile key; config show disagrees with the wire; config edits have no effect

Aberta
  • Algo errado?
#264 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
48/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
typescript
Domínio
authentication, cli

Direção de pesquisa

Start by tracing how the CLI selects credentials for requests and how bl config show resolves the active profile; the report does not name source files or tests. Reproduce with a profile base_url and api_key, then compare the verbose Authorization mask against the active profile key. Done when requests use the active profile's key and the config view matches the key sent.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

bug
CLI version

2.3.1

Skill version (optional)

2.3.1

Node version

n/a (standalone binary install channel, no Node on machine)

OS

Windows 10 10.0.19045 x86_64 (MINGW64/Git Bash)

Region

cn

Command to reproduce
bl video task get --task-id 00000000-0000-0000-0000-000000000000 --verbose
Expected behavior

The Authorization header should match the active profile's api_key — the same key bl config show reports as active — so the request authenticates against the profile's base_url.

Actual behavior
  • The > Auth: mask printed by --verbose matches the ROOT-level api_key [REDACTED root-level key], while the request URL is the PROFILE's base_url (token-plan regional endpoint) → HTTP 401 InvalidApiKey (request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883, a79cdf7b-a2d0-40ed-9e51-59a2daa02c6e).
  • bl config show reports the PROFILE key [REDACTED profile key] as active — the CLI's own config view contradicts what is sent on the wire.
  • Removing the root-level api_key from config.json does NOT change the key sent on the wire (same root-key mask on the next request) → suggests a credential store outside config.json silently takes precedence.
  • Explicit --config <profile> does not change the sent key either.
  • Control experiments: root key + root base_url → HTTP 200; profile endpoint + explicitly passed valid profile key → HTTP 200. Only the mixed pairing (root key + profile endpoint) fails — which is what the CLI produces by itself.
  • Reproduced on both 1.27.0 and 2.3.1 (on 2.3.1 the wrong Auth header is visible in --verbose before the unrelated HTTP crash of #263).
Full output
> GET https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/tasks/00000000-0000-0000-0000-000000000000
> Auth: [REDACTED root-level key]
> x-dashscope-source-config: {"channel":"bailian-cli","tags":{"t1":"public","t2":"bl","t3":"1.27.0"}}
< 401 Unauthorized
request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883

Error:       Invalid API-key provided.
Status:      HTTP 401 (InvalidApiKey)
Exit code:   1
JSON error (optional)
Already tried
  • bl update and skill version aligned with CLI
  • bl auth status OK for this command
  • Different network / region — still reproduces
How often does this happen?

Always

How was bl invoked?

Agent (Cursor, Claude, etc.)

Notes (optional)
  • Related: #171 (closed) covered 401s for the upload-policy endpoint under token-plan profiles; this report is about the broader credential precedence/mixing affecting every request.
  • Security/UX concern: a key the user can no longer see or edit in config.json keeps being used; there is no documented way to inspect or clear that external credential store via bl.
  • Attribution: automatically drafted and submitted by the agentic assistant (model: qwen3.8-max) of Qoder CN Desktop v0.4.3 (build 0.4.3.0) on behalf of the account owner, who reviewed and approved the content before submission.
Linguagem predominante
TypeScript
Estrelas
475
Forks
34
Merge médio
19h 34min
PRs com merge (30d)
34

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de modelstudioai/cli

Todas as issues de modelstudioai/cli

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.