Skip to main content
Authentication failures are HTTP-level: a 401 with a JSON body such as {"detail": "No credentials provided"} and a WWW-Authenticate challenge header. Once authenticated, tool-call failures arrive as JSON-RPC errors with a reason code in error.data.reason instead - those are covered in Tasks & Sessions and Devices.

​
OAuth issues

  • Remove or clear the MCP connection’s saved authentication, reconnect, and complete AGI sign-in again
  • Confirm the OAuth browser flow uses the same AGI account as the Android app - a mismatch shows up later as an empty device list
  • insufficient_scope means the OAuth grant is missing the required email scope; remove and recreate the connection
  • In Claude Code, use Clear authentication from /mcp to sign in with a different AGI account
  • OAuth-capable clients discover everything automatically: add https://api.agi.tech/v1/mcp with no token or custom header and let the client run discovery, registration, and browser sign-in
OAuth access tokens are accepted only by the MCP endpoint. They do not replace API-key or session authentication on other AGI REST APIs.

​
API key issues

  • Double-check your key by copying it directly from platform.agi.tech/me/api-keys
  • Make sure the header is formatted as Authorization: Bearer YOUR_API_KEY (note the space after Bearer)
  • Check if the key has been revoked or expired in the dashboard
  • Confirm the header is actually sent on every MCP request, including tool-list requests - some clients need the header configured per server

​
Decoding the errors

​
Revoking access

  • OAuth: clear the connection’s saved authentication in your client, or revoke the grant via the authorization server’s revocation endpoint
  • API keys: revoke and regenerate at platform.agi.tech/me/api-keys - anyone with your key can control your registered devices

Authentication reference

The full OAuth 2.1 flow - PKCE, discovery, dynamic client registration