refactor: simplify auth flow — remove CORA_API_KEY, centralize to auth.toml#203
Merged
Conversation
…h.toml - Remove CORA_API_KEY env var from clap flag and build_llm_config - auth.toml is now the single source of truth for persisted credentials - Interactive login now auto-detects provider env vars (e.g. ZAI_API_KEY) - Model and base URL show defaults from preset, enter to accept - Non-interactive login also auto-detects provider env vars - Fix provider info from auth.toml being ignored at runtime (build_llm_config now reads stored provider/model/base_url) - Update status/remove/init/providers messages
This was referenced Jun 7, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove redundant
CORA_API_KEYenv var and centralize all auth to~/.cora/auth.toml.Changes
Remove CORA_API_KEY env var
main.rs:--api-keyflag no longer readsCORA_API_KEYenvloader.rs:build_llm_config()no longer checksCORA_API_KEYloader.rs:auth_status()no longer checksCORA_API_KEYFix: provider info from auth.toml now used at runtime
build_llm_config()now loadsstored_provider_infofrom auth.tomlCORA_*env vars > auth.toml > auto-detected preset > config defaultscora reviewshowed "Sending to openai" despite auth.toml having zai configuredImproved interactive login (
cora auth login)ZAI_API_KEY)Improved non-interactive login
cora auth login --provider zaiauto-detectsZAI_API_KEYfrom env--api-keyflag if provider env var is setUpdated messages
init.rs,providers.rs,auth.rs— removed CORA_API_KEY referencesNew API Key Resolution Priority
--api-keyflag~/.cora/auth.tomlZAI_API_KEY,OPENAI_API_KEY, etc.)Test Plan
cora auth statusshows correct provider from auth.tomlcora reviewsends to correct provider (zai, not openai)cora review --streamshows "Streaming from zai (glm-5.1)"