DeepSeek Harness · run failure
dsh run failed: 401 “API Key appears to be invalid or may have expired”
401: The API Key appears to be invalid or may have expired
The provider rejected the request because the credential it received is not valid. The turn ended with `{"kind":"error","code":"AUTH"}`.
provider 拒绝了请求，因为它收到的凭证无效。turn 以 `{"kind":"error","code":"AUTH"}` 结束。
Why it happens根因
The key is expired, revoked, rotated, or belongs to a different provider route than the one the request went to. This class clusters in time around credential changes — and, in practice, around model switches, when the new model is served by a route the existing key does not cover.
key 已过期、被撤销、已轮换，或属于与本次请求不同的 provider 路由。这一类会在凭证变更前后成簇出现——实践中也常出现在切模型时：新模型由一条现有 key 不覆盖的路由提供服务。
How to fix it怎么修
- Replace the key: the provider says this one is invalid or expired.
- Confirm which route the request used — `npx dsh-why` reports the credential route dsh resolved.
- If you recently switched models, switch back and re-run to confirm the key is the variable.
npx dsh-why run see every run failure this can name看它能定性的全部运行期失败- 换 key：provider 明确说这一个无效或已过期。
- 确认请求走的是哪条路由——`npx dsh-why` 会报告 dsh 解析到的凭证路由。
- 如果最近换过模型，先切回去重跑一次，确认变量就是这把 key。
npx dsh-why run see every run failure this can name看它能定性的全部运行期失败Is this my plugin’s fault?这是我的插件引起的吗？
No. This is a local configuration state, not code. Nothing in your plugin set can set or unset a credential.
不是。这是本地配置状态，不是代码问题。你装的任何插件都无法设置或取消一个凭证。
Related failures相关失败
llm-deepseek: no API key for provider route "deepseek-official"no key for this route503 "pricing not configured for provider/model"no pricing for this modelclient-modules: require("…") missed the module table— or the other way round: dsh will not start at all
FAQ常见问题
dsh worked yesterday and now returns 401 — what changed?
Either the key changed upstream, or the request started using a route the key does not cover. `npx dsh-why run --all` shows whether other failure classes started on the same day, which points at a configuration change rather than a network fault.
Where does dsh read the API key from?
From the credentials store the web client’s Models page writes, and from the environment dsh was booted with. `npx dsh-why` prints the route and the store involved.
Is a 401 ever caused by a plugin?
No. This is a local configuration state, not code. Nothing in your plugin set can set or unset a credential.
dsh 昨天还好好的，现在返回 401，改了什么？
要么 key 在上游变了，要么请求开始走一条 key 不覆盖的路由。`npx dsh-why run --all` 会显示同一天是否还有其他类别开始出现，那说明是配置变更而不是网络问题。
dsh 从哪里读取 API key？
来自 web 客户端 Models 页面写入的凭证库，以及 dsh 启动时的环境变量。`npx dsh-why` 会打印相关路由与存储位置。
401 会是插件引起的吗？
不是。这是本地配置状态，不是代码问题。你装的任何插件都无法设置或取消一个凭证。