[justinwlin]

flash could not authenticate from a ~/.runpod/config.toml written by runpodctl. runpodctl writes a top-level apikey key with no [default] profile table, but get_api_key() only consulted runpod-python's profile-based get_credentials(), which returns no key in that case — so flash reported "No RunPod API key found" about a file it read without error that contained a valid key. This adds a file-based fallback: when the profile lookup finds no usable api_key, flash parses the config file directly (via tomllib) and returns the top-level apikey (apiurl stays ignored). Precedence is unchanged: env var > [default].api_key > runpodctl top-level apikey.

Fixes #363
Internal: CON-1228

What changed

• src/runpod_flash/core/credentials.py: get_api_key() now falls back to a new _get_runpodctl_api_key() helper that parses the credential file with tomllib and returns the top-level apikey when the [default] profile has no usable key. Missing file, malformed TOML, and blank/non-string keys all yield None as before.
• tests/unit/test_credentials.py: new tests — runpodctl-format config (top-level apikey only) yields the key; [default] profile takes precedence over the top-level key; blank top-level apikey is ignored; no credentials file still raises RunpodAPIKeyError via validate_api_key().

How verified

• pytest tests/unit/test_credentials.py tests/unit/test_credential_migration.py — 33 passed.
• pytest on all credential/login/API-key-related unit files (7 files) — 104 passed.
• ruff check and ruff format --check on both touched files — clean.
• mypy full run: no net-new errors vs main (261 pre-existing errors; the 2 attributed to credentials.py are pre-existing patterns — tomllib stub and Any return — identical before and after).

The write path (save_api_key) already preserved runpodctl's top-level keys; this PR only fixes the read path.

Related Flash PRs

PR	What it does	Status (2026-10-29)	Remaining
runpod-workers/flash#113	Installs torchvision in the GPU load-balancer image	Merged 2026-10-27, not released	Ships with release PR runpod-workers/flash#112 (1.6.1), still open.
#390	Keeps torch's dependency tree out of flash build archives	Merged 2026-10-29	Needs the 1.6.1 worker image live before runpod-flash 1.21.1 publishes.
#394	Waits for cold-start jobs instead of failing at 90s, and prints a working curl example after flash deploy	Merged 2026-10-29	Ships in runpod-flash 1.21.1. The release commit is on main, but the Release workflow failed, so it isn't tagged or on PyPI yet.
runpod/docs#923	Matches the Flash quickstart and tutorials to a live run on 1.21.0	Merged 2026-10-29	Revisit the 90-second and curl guidance once 1.21.1 is on PyPI.
#369	Reads runpodctl's top-level apikey as a credentials fallback	Closed 2026-10-29	Superseded by #363 and #382.

[justinwlin]

Closing as superseded: the runpodctl top-level compatibility work landed through #363 and was subsequently refined in #382.

[justinwlin]

Clarification: this concerns runpodctl’s top-level apikey field. The compatibility work landed through #363 and was subsequently refined in #382.