# Access and setup problems

Source: https://convergingthought.com/docs/troubleshooting/access

> Diagnose credentials, scopes, preview gates, and project mismatches before changing code.



Start with the exact HTTP status and `error.code`. Similar-looking setup failures can require different actions: an invalid key, insufficient scope, unavailable execution, and an unfunded project are not interchangeable.

## Unauthorized [#unauthorized]

For `401 unauthorized`, confirm that the server sends `Authorization: Bearer` followed by the full key. A displayed key prefix is not enough. Check whether the key expired or was revoked and whether the environment variable contains an accidental newline, quote, or placeholder.

Use a read-only `/v1/models` request as an initial authentication check. Do not paste the key into a browser URL, a support message, or an online request debugger. If the full key was lost, create and install a replacement through the console.

## Permission denied [#permission-denied]

`insufficient_scope` means authentication succeeded but the key lacks a required permission. An inference or learning key can poll jobs it submitted; project-wide inspection requires `read`. A learning key needs `internalize`; manual activation needs `adapters`.

`server_keys_only` means an Origin header reached the public API. Move the call behind your application's authenticated backend. A browser-visible key should be revoked if it was exposed; removing a frontend header does not make that key private.

## Preview only [#preview-only]

`preview_only` is the hosted deployment's execution gate. It is not fixed by creating more keys, using a different subject, or completing a purchase preview. Read [Preview availability](/docs/getting-started/availability) for the current state.

Guest sessions are for exploring the console. They are not a substitute for durable production account access. Email delivery is still pending setup in this deployment, so an unavailable email flow should not be diagnosed as an adapter or API problem.

## Wrong project or missing resource [#wrong-project-or-missing-resource]

A key chooses its owning project. Switching projects in the browser does not change a server's installed key. If a known job returns `not_found`, verify the key's project and the full job ID before assuming the job was deleted.

Subject names are case-sensitive and project-local. `support` in one project is not the same model memory as `support` in another. Compare the submitted subject with the intended server-side mapping.

## Invalid request [#invalid-request]

For `422`, check JSON syntax, content type, idempotency-key format, unknown fields, and endpoint-specific limits. An inference must end with a user message or a completed tool-result block. A learning passage must be at least 20 string-length units. Provider clients should use `/v1/chat/completions`; the native `/v1/inferences` endpoint has a different request shape.

Use the [API reference](/docs/api-reference) rather than repeatedly changing unrelated settings. If the minimal valid request still fails, send the request ID and redacted request shape through the [diagnostics procedure](/docs/troubleshooting/diagnostics).