diff --git a/internal/gateway/commandcode_go_key_test.go b/internal/gateway/commandcode_go_key_test.go
new file mode 100644
index 00000000..712dcce7
--- /dev/null
+++ b/internal/gateway/commandcode_go_key_test.go
@@ -0,0 +1,41 @@
+package gateway
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/yetone/magpie/internal/provider"
+)
+
+// A Go plan's key added as a Command Code API-key provider is refused by
+// the Provider API (#969); the error the agent sees says where the key
+// works, on every protocol the preset serves.
+func TestCommandCodeGoKeySaysWhereItWorks(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.Copy(io.Discard, r.Body)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(403)
+		io.WriteString(w, `{"error":{"type":"forbidden","message":"Your Go plan doesn't include API access. Upgrade to Provider or higher at https://commandcode.ai/billing to use these endpoints."}}`)
+	}))
+	defer up.Close()
+	if err := provider.Save(provider.Provider{ID: "commandcode", Name: "Command Code", Key: "k", Models: []string{"m1"},
+		Chat: up.URL + "/provider/v1", Responses: up.URL + "/provider/v1", Anthropic: up.URL + "/provider"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, q := range []struct{ path, body string }{
+		{"/v1/chat/completions", `{"model":"commandcode/m1","messages":[{"role":"user","content":"hi"}]}`},
+		{"/v1/messages", `{"model":"commandcode/m1","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}`},
+		{"/v1/responses", `{"model":"commandcode/m1","input":"hi"}`},
+	} {
+		forgetRouting()
+		code, body := post(t, q.path, q.body)
+		if code < 400 || !strings.Contains(body, "Go plan doesn't include API access") || !strings.Contains(body, "Plugins › Command Code") {
+			t.Errorf("%s: %d %s", q.path, code, body)
+		}
+	}
+}
diff --git a/internal/provider/decide_test.go b/internal/provider/decide_test.go
index 45e00436..d3a22902 100644
--- a/internal/provider/decide_test.go
+++ b/internal/provider/decide_test.go
@@ -514,6 +514,11 @@ func TestAPIErrorShapes(t *testing.T) {
 	if got := APIError(nil, "400 Bad Request"); got != "400 Bad Request" {
 		t.Fatal(got)
 	}
+	// Command Code's refusal of a Go plan's key says where it works (#969)
+	goKey := `{"error":{"type":"forbidden","message":"Your Go plan doesn't include API access. Upgrade to Provider or higher at https://commandcode.ai/billing to use these endpoints."}}`
+	if got := APIError([]byte(goKey), "403 Forbidden"); got != "Your Go plan doesn't include API access. Upgrade to Provider or higher at https://commandcode.ai/billing to use these endpoints. — "+CommandCodeGoHint {
+		t.Fatal(got)
+	}
 }
 
 // A backend that only streams is tested with a streamed request: WorkBuddy
diff --git a/internal/provider/test.go b/internal/provider/test.go
index c3dcd294..ff9e6b05 100644
--- a/internal/provider/test.go
+++ b/internal/provider/test.go
@@ -510,9 +510,22 @@ func APIError(b []byte, fallback string) string {
 	if link, ok := Verification(b); ok {
 		return VerifyMessage(apiError(b, fallback), link)
 	}
+	if cmdGoNoAPI.Match(b) {
+		return apiError(b, fallback) + " — " + CommandCodeGoHint
+	}
 	return apiError(b, fallback)
 }
 
+// cmdGoNoAPI is Command Code's Provider API refusing a Go plan's key:
+// "Your Go plan doesn't include API access. Upgrade to Provider or higher
+// …" (#969). Go's key is only taken where Command Code's CLI asks, which
+// the Command Code plugin does; an API-key provider (the "commandcode"
+// preset) never can.
+var cmdGoNoAPI = regexp.MustCompile(`(?i)\bGo plan doesn.t include API access`)
+
+// CommandCodeGoHint says where a Go plan's key works.
+const CommandCodeGoHint = "a Go plan's key works in magpie through the Command Code plugin (Plugins › Command Code, then sign in with the key), which asks Command Code as its CLI does; a Command Code API-key provider can't use it"
+
 // verifyWords is a refusal asking for the account to be verified, put in
 // words rather than as VALIDATION_REQUIRED — or already by VerifyMessage.
 var verifyWords = regexp.MustCompile(`(?i)verify your account|account verification required|` + verifyAdvice)