# Authentication or access is failing

> Resolve sign-in, API-key, project, and missing-scope failures without widening access unnecessarily.

Canonical page: https://anectico.com/docs/help/authentication-and-access/


Use the HTTP status or CLI error to separate credential, scope, project, and resource problems.

## 401: the credential was not accepted

1. Confirm the key begins with `an_` and was copied without quotes or whitespace.
2. Confirm it has not expired or been revoked in **Settings → Access**.
3. Send one supported authentication header, not several competing values.
4. Confirm SDK exporters are pointed at `https://api.anectico.com`; CLI and direct REST clients use
   `https://app.anectico.com`.
5. For CLI browser login, run `anectico login` again and then `anectico whoami`.

If a key was exposed, revoke it instead of testing it further.

## 403: the principal is authenticated but not allowed

Read the failed operation, then add only the exact required scope. MCP writes require `mcp:write`
and the relevant domain permission. Some organization configuration and destructive scopes can only
be granted by an owner or admin.

Do not fix a 403 by replacing a narrow automation key with a human administrator key.

### OAuth MCP connection: generic 403 after sign-in

An OAuth-connected MCP client gets one generic `403` when the signed-in identity cannot be matched
to an existing Anectico membership. The response deliberately does not say whether the account,
organization, or membership exists.

For first access, ask an organization owner to invite or provision the person. Complete the normal
Anectico sign-in (or `anectico login`) once, accept any invitation, and reconnect the MCP client. If
the person already exists, give support the attempt time and signed-in address without sending the
access token. The protected audit trail distinguishes a missing account from an existing account
whose external identity still needs linking, a conflicting link, and a missing membership.

### Sign-in 403: "your identity provider has not verified this email address"

Anectico attaches a new sign-in identity to an existing account only when the identity provider
states that the address has been verified. If it does not, the sign-in is refused rather than
completed, because an unverified address is a claim rather than proof of ownership.

Ask the administrator of your identity provider to verify the address (or enable the verified
email claim on the connection), then sign in again. Signing in through a different provider or
a different address will create a separate account, not merge into the existing one. Retrying
the same sign-in will refuse identically until the address is verified.

## 404: verify project and tenant context

A resource outside the authenticated organization or project can appear missing. Confirm the
dashboard project, CLI project (`anectico projects use <slug>`), and key project restriction. Do not try
to widen a project-scoped key with a `project_id` query parameter.

## Dashboard sign-in loops

Retry in a normal browser window with cookies enabled for `app.anectico.com`. If the organization was just
provisioned, confirm the invited email matches the identity provider account. Capture the exact time
and visible error without including session cookies.

- [Authentication and API keys](/docs/reference/authentication)
- [Permission scopes](/docs/reference/permissions)