Why does the sandbox SDK raise CWSandboxAuthenticationError or WandbAuthError?

Which credential the SDK looks for depends on the authentication strategy you select. The SDK doesn’t fall back from one strategy to the other.

CoreWeave (default): reads CWSANDBOX_API_KEY, a CoreWeave API access token, and sends it as a bearer token. Requests go out unauthenticated when the variable isn’t set.
W&B: selected explicitly by passing auth=AuthStrategy.WANDB. Credential discovery is delegated to the wandb library, which accepts an active wandb login session, WANDB_API_KEY, or the api.wandb.ai entry in ~/.netrc.

Check which credential you have configured, without printing its value:

# CoreWeave API access token (the default strategy)
[ -n "$CWSANDBOX_API_KEY" ] && echo "CWSANDBOX_API_KEY is set" || echo "CWSANDBOX_API_KEY is not set"

# W&B API key (requires auth=AuthStrategy.WANDB)
[ -n "$WANDB_API_KEY" ] && echo "WANDB_API_KEY is set" || echo "WANDB_API_KEY is not set"

Common issues

Issue	Solution
No credentials configured	Set `CWSANDBOX_API_KEY`, or set a W&B credential and pass `auth=AuthStrategy.WANDB`
Invalid or expired token	Create a new API access token from the cloud console
W&B credential set but ignored	Pass `auth=AuthStrategy.WANDB`. The SDK doesn’t use a W&B credential unless you select the strategy
`W&B authentication requires the optional wandb dependency`	Install the extra with `uv pip install 'cwsandbox[wandb]'`
Sandbox lands in an unexpected entity or project	Set `WANDB_ENTITY` and `WANDB_PROJECT`. Both are optional; W&B uses your default entity and a `sandbox` project when they’re unset
Netrc parse errors	Check `~/.netrc` file syntax and permissions

Authentication & Access

​Common issues

Common issues