credential_rejected

{
  "meta": {
    "requestId": "req_2c9a0jf23l4k567"
  },
  "error": {
    "detail": "The refresh token is invalid. Run unkey login again.",
    "status": 401,
    "title": "Unauthorized",
    "type": "/errors/unkey/authentication/credential_rejected"
  }
}

​

Likely causes

• The refresh token was already exchanged for a new one, and the 10 second retry window has passed. Reusing it after that, or reusing any older refresh token from the same session, revokes the session.
• The CLI session expired or was revoked from the dashboard. A session expires after 7 days without a refresh, and 30 days after login even when it is used every day.
• The token was copied incompletely, or it belongs to a different API.

​

How to fix

1. Run unkey login and approve the new code.
2. A retry of the refresh token you just exchanged still works for 10 seconds and does not revoke the session. After that, log in again.
3. Confirm UNKEY_API_URL points at the API that issued the session.

​

Related errors

• err:unkey:authentication:key_not_found: a root key in the Authorization header is not recognized.
• err:unkey:authentication:malformed: the Authorization header is not Bearer <token>.
• err:unkey:authorization:forbidden: the refresh token was valid, but the member no longer has the session’s permissions.