[bug] request Authorization header uses root-level api_key instead of active profile key; config show disagrees with the wire; config edits have no effect #264

CLI version

2.3.1

Skill version (optional)

2.3.1

Node version

n/a (standalone binary install channel, no Node on machine)

OS

Windows 10 10.0.19045 x86_64 (MINGW64/Git Bash)

Region

cn

Command to reproduce

bl video task get --task-id 00000000-0000-0000-0000-000000000000 --verbose

Expected behavior

The Authorization header should match the active profile's api_key — the same key bl config show reports as active — so the request authenticates against the profile's base_url.

Actual behavior

• The > Auth: mask printed by --verbose matches the ROOT-level api_key [REDACTED root-level key], while the request URL is the PROFILE's base_url (token-plan regional endpoint) → HTTP 401 InvalidApiKey (request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883, a79cdf7b-a2d0-40ed-9e51-59a2daa02c6e).
• bl config show reports the PROFILE key [REDACTED profile key] as active — the CLI's own config view contradicts what is sent on the wire.
• Removing the root-level api_key from config.json does NOT change the key sent on the wire (same root-key mask on the next request) → suggests a credential store outside config.json silently takes precedence.
• Explicit --config <profile> does not change the sent key either.
• Control experiments: root key + root base_url → HTTP 200; profile endpoint + explicitly passed valid profile key → HTTP 200. Only the mixed pairing (root key + profile endpoint) fails — which is what the CLI produces by itself.
• Reproduced on both 1.27.0 and 2.3.1 (on 2.3.1 the wrong Auth header is visible in --verbose before the unrelated HTTP crash of [bug] video generate crashes with "undefined is not an object (evaluating 'Dispatcher.prototype.compose.call')" #263).

Full output

> GET https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/tasks/00000000-0000-0000-0000-000000000000
> Auth: [REDACTED root-level key]
> x-dashscope-source-config: {"channel":"bailian-cli","tags":{"t1":"public","t2":"bl","t3":"1.27.0"}}
< 401 Unauthorized
request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883

Error:       Invalid API-key provided.
Status:      HTTP 401 (InvalidApiKey)
Exit code:   1

JSON error (optional)

Already tried

• bl update and skill version aligned with CLI
• bl auth status OK for this command
• Different network / region — still reproduces

How often does this happen?

Always

How was bl invoked?

Agent (Cursor, Claude, etc.)

Notes (optional)

• Related: [bug] local file upload (upload policy) always 401 InvalidApiKey under token-plan profile #171 (closed) covered 401s for the upload-policy endpoint under token-plan profiles; this report is about the broader credential precedence/mixing affecting every request.
• Security/UX concern: a key the user can no longer see or edit in config.json keeps being used; there is no documented way to inspect or clear that external credential store via bl.
• Attribution: automatically drafted and submitted by the agentic assistant (model: qwen3.8-max) of Qoder CN Desktop v0.4.3 (build 0.4.3.0) on behalf of the account owner, who reviewed and approved the content before submission.