> ## Documentation Index
> Fetch the complete documentation index at: https://www.unkey.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Unkey is two separate products. Compute builds, deploys, and runs apps behind a gateway. API Management issues API keys, enforces rate limits, manages identities and permissions, and reports usage. Say which product a page belongs to; a reader can use either without the other.
> Every Unkey API endpoint is an HTTP POST to https://api.unkey.com/v2/{service}.{procedure} with a root key in the Authorization: Bearer header. Root keys are workspace scoped.
> Error codes have the form err:{system}:{category}:{specific} and each has a page at /errors/{system}/{category}/{specific}.
> The word environment means production or preview in Compute. Rate limiting has four meanings on this site; the glossary lists them.

# credential_rejected

> The CLI refresh token is unknown, expired, revoked, or already used.

> [!CAUTION]
>
> `err:unkey:authentication:credential_rejected`

The refresh token for a CLI session was not accepted. You get HTTP 401.

```json Example response theme={"system"}
{
  "meta": {
    "requestId": "req_2c9a0jf23l4k567"
  },
  "error": {
    "detail": "The refresh token is invalid. Run unkey login again.",
    "status": 401,
    "title": "Unauthorized",
    "type": "/errors/unkey/authentication/credential_rejected"
  }
}
```

## Likely causes

* The refresh token was already exchanged for a new one, and the 10 second retry window has passed. Reusing it after that, or reusing any older refresh token from the same session, revokes the session.
* The CLI session expired or was revoked from the dashboard. A session expires after 7 days without a refresh, and 30 days after login even when it is used every day.
* The token was copied incompletely, or it belongs to a different API.

## How to fix

1. Run `unkey login` and approve the new code.
2. A retry of the refresh token you just exchanged still works for 10 seconds and does not revoke the session. After that, log in again.
3. Confirm `UNKEY_API_URL` points at the API that issued the session.

## Related errors

* [`err:unkey:authentication:key_not_found`](https://www.unkey.com/docs/errors/unkey/authentication/key_not_found): a root key in the Authorization header is not recognized.
* [`err:unkey:authentication:malformed`](https://www.unkey.com/docs/errors/unkey/authentication/malformed): the Authorization header is not `Bearer <token>`.
* [`err:unkey:authorization:forbidden`](https://www.unkey.com/docs/errors/unkey/authorization/forbidden): the refresh token was valid, but the member no longer has the session's permissions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.