Repository navigation
GOAT plan: Provider API returns 401 authentication_error on every request #1040
Description
Summary
GOAT plan active, but Provider API returns 401 authentication_error on every request — API completely unusable
Expected Behavior
With an active GOAT plan (API access enabled in Studio → Billing) and a freshly generated API key from Studio → API keys, a request to POST https://api.commandcode.ai/provider/v1/chat/completions with Authorization: Bearer <CMD_API_KEY> should return a normal chat completion.
Actual Behavior
Every request returns HTTP 401:
{"error":{"message":"Invalid 'Authorization' header or token.","type":"authentication_error","code":"UNAUTHORIZED"}}
The error type is authentication_error — the request is rejected at the auth stage, before the model id is validated. The same key also fails in the CLI with a real model request (Authentication failed). So the credential itself appears to be rejected server-side.
Steps to reproduce the issue
- Subscribe to the GOAT plan and confirm API access is enabled in Studio → Billing.
- Generate a fresh API key from Studio → API keys (the generated value is user_-prefixed).
- Call the API with raw curl:
curl https://api.commandcode.ai/provider/v1/chat/completions
-H "Authorization: Bearer <CMD_API_KEY>"
-H "Content-Type: application/json"
-d '{"model":"deepseek/deepseek-v4.1-flash","messages":[{"role":"user","content":"Reply one word: HALO"}],"max_tokens":20}'
- Observe the 401 response above.
Ruled out (all still 401):
• 5 different freshly generated keys (all user_-prefixed)
• All routes: /chat/completions, /responses, /messages, /systemone
• Exact case-sensitive model ids copied from /models
• Header styles: Authorization: Bearer, plain Authorization, x-api-key, Token, and query param
• Copy/paste damage: length + trailing-byte check clean; key sent via an exported env var
• Same key in the CLI (command-code -p "...") → Authentication failed
Command Code Version
1.84.0
Operating System
Windows
Terminal/IDE
Unknown
Shell
cmd.exe
Session file (optional)
No response
Fix prompt (optional)
No response
Additional context
• Plan: GOAT (active; API access enabled in Studio → Billing)
• Base URL: https://api.commandcode.ai/provider/v1
• CLI: command-code v1.84.0 on Windows
• The same token 401s in both the CLI and the API, which suggests a credential/server-side issue rather than a request-shape problem.
• Happy to share the account email and key privately (via DM) for staff to investigate.
Activity
ahmadbilaldev commentedon Oct 17, 2026
@mediacerebri can you share the trace too, taking a look.
mediacerebri commentedon Oct 17, 2026
Thanks for looking into this! Here's the trace:
Environment
• Plan: GOAT
• CLI: command-code v1.84.0 (current npm latest)
• Client: direct HTTP calls to https://api.commandcode.ai/provider/v1
• OS: Linux (headless server, no GUI)
What works
$ command-code status
✔ Authentication verified
✔ Authenticated
Provider: Command Code
$ curl -s https://api.commandcode.ai/provider/v1/models -H "Authorization: Bearer "
HTTP 200 # full 93-model catalog returned, no auth error
What fails
$ curl -s -w "\nHTTP:%{http_code}\n"
https://api.commandcode.ai/provider/v1/chat/completions
-H "Authorization: Bearer "
-H "Content-Type: application/json"
-d '{"model":"deepseek/deepseek-v4.1-flash","messages":[{"role":"user","content":"ping"}],"max_tokens":5}'
HTTP:401
{"error":{"message":"Invalid 'Authorization' header or token.","type":"authentication_error","code":"UNAUTHORIZED"}}
$ command-code whoami
✖ Error: 401 Invalid 'Authorization' header or token.
What I've tried (all 401)
• Models: deepseek/deepseek-v4.1-flash, -fast, plus one other
• Routes: /chat/completions, /responses, /messages, /systemone
• Header styles: Authorization: Bearer , raw token, x-api-key: , Token , query param
• Key sources: env var, ~/.commandcode/auth.json, ~/.commandcode/token.json, ~/.commandcode/credentials.json
Key observation
• The values in ~/.commandcode/{auth,token,credentials}.json are user_... strings. Support said these are CLI session credentials, not Provider API keys — the real Provider key must be generated in Studio → API keys. But I don't see where to generate it, and using the credentials I have still yields 401 on every inference call. Meanwhile command-code status reports "Authenticated" locally, which looks like it only checks for presence of the credential file, not server-side validity.
mediacerebri commentedon Oct 17, 2026
Thanks! Here's the trace info you asked for:
Trace ID: x-trace-id: bef1e27b0850c3fe77b76882aab17904
Cloudflare Ray: cf-ray: a4c158a8980eecf2-CGK
Timestamp: 2026-10-17 18:25:31 UTC
Endpoint: POST https://api.commandcode.ai/provider/v1/chat/completions
Response: HTTP 401 · {"error":{"message":"Invalid 'Authorization' header or token.","type":"authentication_error","code":"UNAUTHORIZED"}}
Full response headers:
HTTP/1.1 401 Unauthorized
date: Sat, 17 Oct 2026 18:25:31 GMT
content-type: application/json
content-length: 116
server-timing: total;dur=216.0;desc="Total Response Time"
x-powered-by: Hono
x-trace-id: bef1e27b0850c3fe77b76882aab17904
server: cloudflare
cf-ray: a4c158a8980eecf2-CGK
A couple of things that might help confirm whether it's config or server-side:
• GET /provider/v1/models (same host, no auth validation) returns HTTP 200 with the full catalog — so reachability is fine, only auth fails.
• command-code whoami also returns 401 (no trace header there), while command-code status reports "✔ Authenticated" locally — looks like the local check only verifies the credential file exists, not that the token is valid server-side.
• The credential values I have are user_... strings from ~/.commandcode/{auth,token,credentials}.json. If those are CLI session credentials rather than Provider API keys, can you confirm the exact steps to generate a valid Provider key for a GOAT plan?
Happy to run any additional diagnostic. Thanks! 🙏
mediacerebri commentedon Oct 17, 2026
Resolved — the working key is the long user_... token (92 chars); the CLI credential files contained placeholder *** values. API returns HTTP 200 now. Thanks!