Authentication or access is failing

Use the HTTP status or CLI error to separate credential, scope, project, and resource problems.

Sign in or create an account

Sign-in and account creation use the same passwordless flow. Enter your email address, then enter the six-digit code sent to your inbox. The code expires after five minutes. Your first sign-in creates your account and a personal workspace. On the code page, you can request a new code when the resend countdown finishes or use a different email address.

You can also choose GitHub or Google when those buttons are available; use a verified primary email address. To join a team's workspace, accept its invitation using the invited address.

On desktop, sign-in and account-creation pages show an animated background beside the form. The animation starts automatically.

For the CLI, run anectico login, open the displayed page and review the code and requesting client. Only approve if you just ran that command yourself. Device codes expire after ten minutes.

Complete browser sign-out

Signing out clears the Console session, then opens a sign-out page to end the separate sign-in session before returning to the app. Complete any confirmation shown on that page.

For a direct browser integration, POST /auth/logout returns HTTP 200 with a JSON object containing sign_out_url, not an empty object or pagination fields. Navigate the browser to that URL unchanged, including its query parameters. The POST itself does not redirect the browser, and clearing the Console cookies alone does not finish signing out of the sign-in session. Do not log or share the returned URL: it may contain a short-lived, single-use sign-out intent.

When a refresh cookie is present, its refresh family is revoked before the Console cookies are cleared. Without a refresh cookie, the response still supplies a sign-out URL, but completing sign-out can require confirmation. If logout returns 503 with Retry-After: 1, cookies are left unchanged so you can retry; do not treat that response as a successful sign-out. API keys are separate credentials and are not revoked by browser logout.

401: the credential was not accepted

1. Confirm the key begins with an_ and was copied without quotes or whitespace.
2. Confirm it has not expired or been revoked. In the Console, open Agents and keys (/agents) and look under API keys, or run anectico apikey list.
3. Send one supported authentication header, not several competing values.
4. Confirm SDK exporters are pointed at https://api.anectico.com; CLI and direct REST clients use https://app.anectico.com.
5. For CLI browser login, run anectico login again and then anectico whoami.

If a key was exposed, revoke it instead of testing it further.

403: the principal is authenticated but not allowed

Read the failed operation, then add only the exact required scope. MCP writes require mcp:write and the relevant domain permission. Some organization configuration and destructive scopes can only be granted by an owner or admin.

Do not fix a 403 by replacing a narrow automation key with a human administrator key.

OAuth MCP connection: generic 403 after sign-in

An OAuth-connected MCP client gets one generic 403 when the signed-in identity cannot be matched to an existing Anectico membership. The response deliberately does not say whether the account, organization, or membership exists.

For first access, ask an organization owner to invite or provision the person. Complete the normal Anectico sign-in (or anectico login) once, accept any invitation, and reconnect the MCP client. If the person already exists, give support the attempt time and signed-in address without sending the access token. The protected audit trail distinguishes a missing account from an existing account whose external identity still needs linking, a conflicting link, and a missing membership.

Sign-in 403: "your identity provider has not verified this email address"

Anectico attaches a new sign-in identity to an existing account only when the identity provider states that the address has been verified. If it does not, the sign-in is refused rather than completed, because an unverified address is a claim rather than proof of ownership.

Use an email code to verify ownership, or verify your primary email with the chosen provider. An existing account whose address was never verified cannot be linked automatically; contact support without sharing codes or tokens.

If sending a sign-in code fails, Anectico shows an error. Wait briefly and request a new code. If the request succeeds but the email does not arrive, check your spam folder and confirm the address before requesting another code. Use the most recent code; never share it with support.

404: verify project and tenant context

A resource outside the authenticated organization or project can appear missing. Confirm the project in the Console header, CLI project (anectico projects use <slug>), and key project restriction. Do not try to widen a project-scoped key with a project_id query parameter.

Console sign-in loops

Retry in a normal browser window with cookies enabled for app.anectico.com. If the organization was just provisioned, confirm the invited email matches the identity provider account. Capture the exact time and visible error without including session cookies.

• Authentication and API keys
• Permission scopes

Accepting an invitation

Sign in with the verified email address that received the invitation, then open the invitation link. Invitations must be accepted by a person; API keys and connected agents cannot accept them. If your current session predates email verification, sign in again before retrying.