Skip to content
anecticoDocs
Dashboard
Browse documentation
Troubleshooting

Authentication or access is failing

Resolve sign-in, API-key, project, and missing-scope failures without widening access unnecessarily.

Read as Markdown ↗Use with an LLM ↗
On this page

Use the HTTP status or CLI error to separate credential, scope, project, and resource problems.

401: the credential was not accepted

  1. Confirm the key begins with an_ and was copied without quotes or whitespace.
  2. Confirm it has not expired or been revoked in Settings → Access.
  3. Send one supported authentication header, not several competing values.
  4. Confirm SDK exporters are pointed at https://api.anectico.com; CLI and direct REST clients use https://app.anectico.com.
  5. For CLI browser login, run anectico login again and then anectico whoami.

If a key was exposed, revoke it instead of testing it further.

403: the principal is authenticated but not allowed

Read the failed operation, then add only the exact required scope. MCP writes require mcp:write and the relevant domain permission. Some organization configuration and destructive scopes can only be granted by an owner or admin.

Do not fix a 403 by replacing a narrow automation key with a human administrator key.

OAuth MCP connection: generic 403 after sign-in

An OAuth-connected MCP client gets one generic 403 when the signed-in identity cannot be matched to an existing Anectico membership. The response deliberately does not say whether the account, organization, or membership exists.

For first access, ask an organization owner to invite or provision the person. Complete the normal Anectico sign-in (or anectico login) once, accept any invitation, and reconnect the MCP client. If the person already exists, give support the attempt time and signed-in address without sending the access token. The protected audit trail distinguishes a missing account from an existing account whose external identity still needs linking, a conflicting link, and a missing membership.

Sign-in 403: "your identity provider has not verified this email address"

Anectico attaches a new sign-in identity to an existing account only when the identity provider states that the address has been verified. If it does not, the sign-in is refused rather than completed, because an unverified address is a claim rather than proof of ownership.

Ask the administrator of your identity provider to verify the address (or enable the verified email claim on the connection), then sign in again. Signing in through a different provider or a different address will create a separate account, not merge into the existing one. Retrying the same sign-in will refuse identically until the address is verified.

404: verify project and tenant context

A resource outside the authenticated organization or project can appear missing. Confirm the dashboard project, CLI project (anectico projects use <slug>), and key project restriction. Do not try to widen a project-scoped key with a project_id query parameter.

Dashboard sign-in loops

Retry in a normal browser window with cookies enabled for app.anectico.com. If the organization was just provisioned, confirm the invited email matches the identity provider account. Capture the exact time and visible error without including session cookies.