> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agi.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Fix OAuth and API key failures.

Authentication failures are **HTTP-level**: a `401` with a JSON body such as `{"detail": "No credentials provided"}` and a `WWW-Authenticate` challenge header. Once authenticated, tool-call failures arrive as JSON-RPC errors with a reason code in `error.data.reason` instead - those are covered in [Tasks & Sessions](/guides/troubleshooting/tasks) and [Devices](/guides/troubleshooting/devices).

## OAuth issues

* Remove or clear the MCP connection's saved authentication, reconnect, and
  complete AGI sign-in again
* Confirm the OAuth browser flow uses the **same AGI account** as the Android
  app - a mismatch shows up later as an empty device list
* `insufficient_scope` means the OAuth grant is missing the required `email`
  scope; remove and recreate the connection
* In Claude Code, use **Clear authentication** from `/mcp` to sign in with a
  different AGI account
* OAuth-capable clients discover everything automatically: add
  `https://api.agi.tech/v1/mcp` with **no token or custom header** and let the
  client run discovery, registration, and browser sign-in

<Note>
  OAuth access tokens are accepted only by the MCP endpoint. They do not
  replace API-key or session authentication on other AGI REST APIs.
</Note>

## API key issues

* Double-check your key by copying it directly from
  [platform.agi.tech/me/api-keys](https://platform.agi.tech/me/api-keys)
* Make sure the header is formatted as `Authorization: Bearer YOUR_API_KEY`
  (note the space after `Bearer`)
* Check if the key has been revoked or expired in the dashboard
* Confirm the header is actually sent on **every** MCP request, including
  tool-list requests - some clients need the header configured per server

## Decoding the errors

| Error                                                    | Meaning                                                        | Fix                                                     |
| -------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------- |
| `No credentials provided`                                | The client has not completed OAuth and did not send an API key | Complete OAuth, or configure the `Authorization` header |
| `Invalid token` (including one referencing a Google API) | The key you sent was not recognized                            | Copy a fresh key from the dashboard                     |
| `insufficient_scope`                                     | OAuth grant is missing the `email` scope                       | Remove and recreate the connection                      |
| `401` after it worked before                             | Token expired and refresh failed, or key revoked               | Clear auth and reconnect / issue a new key              |

## Revoking access

* **OAuth:** clear the connection's saved authentication in your client, or
  revoke the grant via the authorization server's revocation endpoint
* **API keys:** revoke and regenerate at
  [platform.agi.tech/me/api-keys](https://platform.agi.tech/me/api-keys) -
  anyone with your key can control your registered devices

## Related

<Card title="Authentication reference" icon="book" href="/api-reference/introduction#authentication">
  The full OAuth 2.1 flow - PKCE, discovery, dynamic client registration
</Card>