From d7f85ee0d1d5933bbb0efb6795919f119ec1051e Mon Sep 17 00:00:00 2001
From: Bortlesboat <bortstheboat@gmail.com>
Date: Tue, 12 May 2026 16:24:20 -0400
Subject: [PATCH] fix: clarify whoami api key source

---
 src/cortex-cli/src/cli/handlers.rs       |  2 +-
 src/cortex-cli/tests/whoami_env_label.rs | 27 ++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 src/cortex-cli/tests/whoami_env_label.rs

diff --git a/src/cortex-cli/src/cli/handlers.rs b/src/cortex-cli/src/cli/handlers.rs
index e92fa8632..3c2c78db3 100644
--- a/src/cortex-cli/src/cli/handlers.rs
+++ b/src/cortex-cli/src/cli/handlers.rs
@@ -551,7 +551,7 @@ pub async fn run_whoami() -> Result<()> {
         && !token.is_empty()
     {
         println!(
-            "Authenticated via CORTEX_API_KEY: {}",
+            "Authenticated via CORTEX_API_KEY environment variable: {}",
             safe_format_key(&token)
         );
         return Ok(());
diff --git a/src/cortex-cli/tests/whoami_env_label.rs b/src/cortex-cli/tests/whoami_env_label.rs
new file mode 100644
index 000000000..ee1b7035e
--- /dev/null
+++ b/src/cortex-cli/tests/whoami_env_label.rs
@@ -0,0 +1,27 @@
+use std::process::Command;
+
+#[test]
+fn whoami_cortex_api_key_names_environment_variable_source() {
+    let output = Command::new(env!("CARGO_BIN_EXE_Cortex"))
+        .arg("whoami")
+        .env("CORTEX_API_KEY", "test-key-for-whoami")
+        .env_remove("CORTEX_AUTH_TOKEN")
+        .output()
+        .expect("run Cortex whoami");
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+
+    assert!(
+        output.status.success(),
+        "whoami failed\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert!(
+        stdout.contains("Authenticated via CORTEX_API_KEY environment variable:"),
+        "expected environment variable source label\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert!(
+        !stdout.contains("Authenticated via CORTEX_API_KEY:"),
+        "stale auth-source wording should not be present\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+}