From f93bd40317486088fa4d0942a1add2cfa9318214 Mon Sep 17 00:00:00 2001
From: "Yufei (Benny) Chen" <1585539+benjibc@users.noreply.github.com>
Date: Sat, 10 Jan 2026 00:17:42 -0800
Subject: [PATCH] Verify Fireworks API key once for CLI flows

---
 eval_protocol/cli_commands/create_rft.py | 2 +-
 eval_protocol/cli_commands/upload.py     | 5 +++--
 eval_protocol/cli_commands/utils.py      | 8 ++++----
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/eval_protocol/cli_commands/create_rft.py b/eval_protocol/cli_commands/create_rft.py
index 702eb2fe..13110c8c 100644
--- a/eval_protocol/cli_commands/create_rft.py
+++ b/eval_protocol/cli_commands/create_rft.py
@@ -729,7 +729,7 @@ def create_rft_command(args) -> int:
         print("Error: FIREWORKS_API_KEY not set.")
         return 1
 
-    account_id = _ensure_account_id()
+    account_id = _ensure_account_id(api_key=api_key)
     if not account_id:
         print("Error: Could not resolve Fireworks account id from FIREWORKS_API_KEY.")
         return 1
diff --git a/eval_protocol/cli_commands/upload.py b/eval_protocol/cli_commands/upload.py
index a8a132d6..0023c395 100644
--- a/eval_protocol/cli_commands/upload.py
+++ b/eval_protocol/cli_commands/upload.py
@@ -294,7 +294,8 @@ def upload_command(args: argparse.Namespace) -> int:
 
     # Load secrets from .env file and ensure they're available on Fireworks
     try:
-        fw_account_id = _ensure_account_id()
+        fw_api_key_value = get_fireworks_api_key()
+        fw_account_id = _ensure_account_id(api_key=fw_api_key_value)
 
         # Determine .env file path
         if env_file:
@@ -307,7 +308,6 @@ def upload_command(args: argparse.Namespace) -> int:
         secrets_from_env_file = secrets_from_file.copy()  # Track what came from .env file
 
         # Also consider FIREWORKS_API_KEY from environment, but prefer .env value
-        fw_api_key_value = get_fireworks_api_key()
         if fw_api_key_value and "FIREWORKS_API_KEY" not in secrets_from_file:
             secrets_from_file["FIREWORKS_API_KEY"] = fw_api_key_value
 
@@ -334,6 +334,7 @@ def upload_command(args: argparse.Namespace) -> int:
                         account_id=fw_account_id,
                         key_name=secret_name,
                         secret_value=secret_value,
+                        api_key=fw_api_key_value,
                     ):
                         print(f"✓ {secret_name} secret created/updated on Fireworks.")
                     else:
diff --git a/eval_protocol/cli_commands/utils.py b/eval_protocol/cli_commands/utils.py
index 1338ae31..91433c3e 100644
--- a/eval_protocol/cli_commands/utils.py
+++ b/eval_protocol/cli_commands/utils.py
@@ -448,12 +448,12 @@ def _normalize_evaluator_id(evaluator_id: str) -> str:
     return normalized
 
 
-def _ensure_account_id() -> Optional[str]:
+def _ensure_account_id(api_key: Optional[str] = None) -> Optional[str]:
     """Resolve Fireworks account id from FIREWORKS_API_KEY via verifyApiKey."""
-    api_key = get_fireworks_api_key()
-    if not api_key:
+    resolved_key = api_key or get_fireworks_api_key()
+    if not resolved_key:
         return None
-    return verify_api_key_and_get_account_id(api_key=api_key, api_base=get_fireworks_api_base())
+    return verify_api_key_and_get_account_id(api_key=resolved_key, api_base=get_fireworks_api_base())
 
 
 def _extract_terminal_segment(resource_name: str) -> str: