Verify Fireworks API key once for CLI flows

eval_protocol/cli_commands/create_rft.py

@@ -729,7 +729,7 @@ def create_rft_command(args) -> int:
         print("Error: FIREWORKS_API_KEY not set.")
         return 1
 
-    account_id = _ensure_account_id()
+    account_id = _ensure_account_id(api_key=api_key)
     if not account_id:
         print("Error: Could not resolve Fireworks account id from FIREWORKS_API_KEY.")
         return 1

eval_protocol/cli_commands/upload.py

@@ -294,7 +294,8 @@ def upload_command(args: argparse.Namespace) -> int:
 
     # Load secrets from .env file and ensure they're available on Fireworks
     try:
-        fw_account_id = _ensure_account_id()
+        fw_api_key_value = get_fireworks_api_key()
+        fw_account_id = _ensure_account_id(api_key=fw_api_key_value)
 
         # Determine .env file path
         if env_file:
@@ -307,7 +308,6 @@ def upload_command(args: argparse.Namespace) -> int:
         secrets_from_env_file = secrets_from_file.copy()  # Track what came from .env file
 
         # Also consider FIREWORKS_API_KEY from environment, but prefer .env value
-        fw_api_key_value = get_fireworks_api_key()
         if fw_api_key_value and "FIREWORKS_API_KEY" not in secrets_from_file:
             secrets_from_file["FIREWORKS_API_KEY"] = fw_api_key_value
 
@@ -334,6 +334,7 @@ def upload_command(args: argparse.Namespace) -> int:
                         account_id=fw_account_id,
                         key_name=secret_name,
                         secret_value=secret_value,
+                        api_key=fw_api_key_value,
                     ):
                         print(f"✓ {secret_name} secret created/updated on Fireworks.")
                     else:

eval_protocol/cli_commands/utils.py

@@ -448,12 +448,12 @@ def _normalize_evaluator_id(evaluator_id: str) -> str:
     return normalized
 
 
-def _ensure_account_id() -> Optional[str]:
+def _ensure_account_id(api_key: Optional[str] = None) -> Optional[str]:
     """Resolve Fireworks account id from FIREWORKS_API_KEY via verifyApiKey."""
-    api_key = get_fireworks_api_key()
-    if not api_key:
+    resolved_key = api_key or get_fireworks_api_key()
+    if not resolved_key:
         return None
-    return verify_api_key_and_get_account_id(api_key=api_key, api_base=get_fireworks_api_base())
+    return verify_api_key_and_get_account_id(api_key=resolved_key, api_base=get_fireworks_api_base())
 
 
 def _extract_terminal_segment(resource_name: str) -> str: