All authenticated API calls return 500 after successful OAuth login (inference, /me, and re-login all fail) — server-side, account-scoped

What version of Kimi Code is running?

0.39.1 (also reproduced on 0.19.2 before upgrading)

Which open platform/subscription were you using?

Kimi Code (kimi.com), region mainland-cn, OAuth device-code flow

What platform is your computer?

macOS (darwin/arm64)

What issue are you seeing?

OAuth login succeeds and a valid access token is issued, but every authenticated API call returns 500 The server had an error while processing your request. From the user's perspective the CLI is unusable: each prompt retries 10 times with exponential backoff and then gives up.

Timeline (from ~/.kimi-code/logs/kimi-code.log):

• First observed 2026-08-31T01:04:56Z on version 0.19.2 (provider.api_error: 500 on startup prompt)
• Continued after upgrading to 0.39.1
• Re-login at ~2026-08-31T18:16Z succeeded — credentials/kimi-code.json contains a freshly issued access_token / refresh_token (scope kimi-code, expires_in: 900)
• All model calls with that valid token still return 500
• A fresh kimi login attempt afterwards now also fails immediately with Login failed: The server had an error while processing your request (same symptom as #3363)

Cross-checks performed (client side ruled out)

1. Two models: both kimi-for-coding and k3 return 500 → not a single-model outage
2. Two client versions: identical 500 on 0.19.2 and 0.39.1 → not a client bug
3. Bypassing the CLI: calling POST https://api.kimi.com/coding/v1/responses directly with curl and the valid access token returns HTTP 500 {"error":{"message":"The server had an error while processing your request","type":"server_error"}}
4. Gateway is alive: the same request with an invalid token correctly returns HTTP 401 invalid_authentication_error in ~0.17s
5. Auth server is alive: POST https://auth.kimi.com/api/oauth/device_authorization with a malformed body correctly returns HTTP 400 invalid_request
6. Account endpoints also fail: GET https://api.kimi.com/coding/v1/me with the valid token returns 500 as well
7. kimi doctor reports all config files valid; no proxy env vars set; network connectivity to both hosts is fine

This points to a server-side problem scoped to authenticated paths for this account (membership/entitlement lookup?), not a client, network, or global edge outage. Possibly related: #3363, #2624.

What steps can reproduce the bug?

1. kimi login --region mainland-cn → complete device-code OAuth in browser → login reports success, token issued
2. kimi -p "hi" → turn.step.retrying events with APIStatusError: 500 The server had an error while processing your request, 10 retries, then failure
3. Run kimi login again → fails immediately with the same 500

What is the expected behavior?

Authenticated requests succeed, or a specific actionable error (e.g. membership expired / quota exhausted) is returned instead of a generic 500.

Additional information

Happy to provide request IDs, full logs, or the credential file metadata privately if helpful.

Start by reproducing the failure with kimi login, kimi -p "hi", and the authenticated /coding/v1/responses and /coding/v1/me requests described in the issue. Trace the CLI authentication and API request entry points to determine whether the client can expose a more specific server response; done means authenticated calls succeed or return an actionable error instead of a generic 500.