Problem

firecrawl --status was reporting Not authenticated and pointing users at firecrawl login whenever the stored credentials only had apiUrl set (e.g. a self-hosted instance). Self-hosted Firecrawl does not require an API key, so this state is a valid configured setup, not a missing-credentials state.

The same code path also produced Authorization: Bearer undefined in outbound requests when apiKey was missing, since the header was unconditionally formatted from a possibly-undefined value.

Tracked as #53.

Repro on main

# Fresh setup, no credentials.json yet
firecrawl config --api-url http://localhost:3002
# credentials.json now contains: { "apiUrl": "http://localhost:3002" }

firecrawl --status
# Reports: Not authenticated. Run 'firecrawl login' to authenticate.

Fix

• Add self-hosted as a new AuthSource in src/commands/status.ts.
• getAuthSource() returns self-hosted when stored credentials have a custom apiUrl and no apiKey.
• getStatus() treats self-hosted as authenticated for reporting purposes, so the status flow keeps going and queries the queue-status / credit-usage endpoints (which the issue notes already succeed against self-hosted instances).
• fetchQueueStatus / fetchCreditUsage now build headers via a small buildStatusHeaders() helper that omits Authorization entirely when there is no apiKey. This removes the Bearer undefined header.
• handleStatusCommand() prints Self-hosted <apiUrl> in green instead of the Not authenticated line for this state.

The cloud paths (env, stored) are unchanged.

Tests

New src/__tests__/commands/status.test.ts with four cases:

• apiUrl custom + no apiKey reports authSource=self-hosted and authenticated=true.
• Authorization header is omitted entirely when self-hosted has no apiKey; the literal string Bearer undefined does not appear in any outgoing request.
• apiKey + custom apiUrl still reports stored (no regression on existing cloud-with-custom-URL flow).
• No apiKey + default cloud URL still reports none and authenticated=false.

Verified locally:

• npx vitest run → 279 passed (16 files).
• npx tsc --noEmit → clean.
• npx prettier --check → clean.

The two new self-hosted tests fail on main (the bug), pass with the fix.