Fix MISSING_CREDENTIAL in DeepSeek Harness
MISSING_CREDENTIAL means the selected route could not resolve the credential reference it needs. Confirm which provider and model the failing session uses, repair that provider’s saved key or named environment reference, and retry a small request. A missing reference and an upstream 401 response are different checks.
Sharing includes the public link only, without local progress or private configuration.
1. Identify the provider used by the failing request
Record the error code, provider ID, model ID and active profile. Read the error’s named credential reference if one is present, without copying its value. A working key configured for one provider does not prove that a different route can resolve its own reference.
Check the model selected in the failing session, then create a fresh session with the provider you repaired. Existing sessions retain the model recorded in their log after the first request; changing the default for new sessions does not rewrite that history.
2. Repair the saved key or the exact environment reference
For a provider configured through Settings → Models, enter the key in its own card and save. The interface stores a credential reference and returns a redacted descriptor; a hidden key field is not proof that saving failed. Do not replace that reference with a raw key in a task prompt.
For direct configuration using apiKeyEnv, inspect the variable name in the effective provider entry. Check that exact name in the shell which starts dsh. The example below tests only whether a sample variable is nonempty; replace GATEWAY_API_KEY with your configured name. It never prints the value.
The reviewed credential resolution order is inherited environment, DSH home’s .credentials.yaml, the invoking directory’s .env, then DSH home’s .env. An old value exported in the launch shell can therefore take precedence over a newly saved key. Compare the source of the named reference before repeatedly replacing the saved credential.
- Environment variable names must match the configured reference exactly.
- A variable added after dsh started is not retroactively inherited by that process; relaunch from the corrected shell.
- If using a .env layer, check its location relative to the launch directory or DSH home instead of assuming every terminal reads it.
node -e 'console.log(Boolean(process.env.GATEWAY_API_KEY) ? "present" : "missing")'What to check: “present” means the Node process inherited a nonempty variable with that name. “missing” says nothing about a key stored in DSH’s credential document or a .env file; check the credential source your provider actually references.
3. Check the profile and later configuration layers
If saving a key seems to work but the same reference still fails, check the actual profile and composed provider entry. The standard Web profile is web; a custom profile has its own patch. A home-level patch or a command-line overlay can replace the provider configuration you expected to use.
The following command inspects the selected Web profile without booting its application. It can initialize missing profile files. Its output is for local inspection: it may contain configuration values or credential-bearing headers, so remove them before sharing a diagnostic excerpt.
npx --yes @deepseek-ai/dsh@0.2.0-rc.2 --profile web --dump-configWhat to check: The composed configuration lists the provider row and comments indicating its source layers. Inspect the route, model list and credential reference locally; a dump is not a network authentication test.
4. Retry once and classify the next result
Select the repaired model in a new session and send a small text request. If MISSING_CREDENTIAL disappears but the provider returns 401 or an authorization error, credential resolution has moved past the original failure; check the key’s validity, access scope and the provider’s account interface next.
If the original code remains, compare the credential reference and profile in the new failure with your repaired entry. Escalate with the dsh version, launch shell, provider/model IDs and sanitized error. Do not include the key, the full credential document or an unreviewed configuration dump.
Credential checks mean different things
| Observation | What it establishes | Next check |
|---|---|---|
| MISSING_CREDENTIAL | The required reference did not resolve for this route. | Provider ID, reference name and active credential source. |
| The shell test prints present | This Node process inherited that variable. | The actual DSH process, selected profile and reference name. |
| A saved key is hidden in Settings | The interface intentionally returns a redacted descriptor. | Save state and a small request; do not infer loss from masking alone. |
| An upstream 401 after repair | The request reached a different authentication failure stage. | Provider validity, permission and account access. |
Frequently asked questions
Is MISSING_CREDENTIAL the same as an invalid API key?
No. A missing reference fails credential resolution. An invalid or unusable credential can produce a different adapter code or a provider-side rejection. Preserve the exact code and diagnose that stage.
Why can the UI show a saved provider while requests still fail?
The saved provider and the failing request may use different model routes, profiles or session history. A later configuration layer can also replace a row. Compare the effective entry and test the repaired model in a fresh session.
Does the shell environment check read DSH’s saved credentials?
No. It only checks the inherited environment of that Node process. DSH’s managed credential document and documented .env layers are separate sources, so a missing shell variable alone does not prove a saved credential is absent.
Should I paste the key into the agent chat to test it?
Configure it through the local Models interface or the documented credential source. The task itself does not need the secret value. Use a small request to test access and share only redacted diagnostics if it fails.
First-party sources
Open the pinned or retrieved source before acting on a changed release candidate.
- Official model configuration guideOfficial documentation · retrieved 2026-10-04↗
- Official DeepSeek adapter referenceOfficial documentation · retrieved 2026-10-04↗
- Official custom-provider adapter referenceOfficial documentation · retrieved 2026-10-04↗
- Official CLI behavior referenceOfficial documentation · retrieved 2026-10-04↗