Access and setup problems
Diagnose credentials, scopes, preview gates, and project mismatches before changing code.
Start with the exact HTTP status and error.code. Similar-looking setup failures can require different actions: an invalid key, insufficient scope, unavailable execution, and an unfunded project are not interchangeable.
Unauthorized
For 401 unauthorized, confirm that the server sends Authorization: Bearer followed by the full key. A displayed key prefix is not enough. Check whether the key expired or was revoked and whether the environment variable contains an accidental newline, quote, or placeholder.
Use a read-only /v1/models request as an initial authentication check. Do not paste the key into a browser URL, a support message, or an online request debugger. If the full key was lost, create and install a replacement through the console.
Permission denied
insufficient_scope means authentication succeeded but the key lacks a required permission. An inference or learning key can poll jobs it submitted; project-wide inspection requires read. A learning key needs internalize; manual activation needs adapters.
server_keys_only means an Origin header reached the public API. Move the call behind your application's authenticated backend. A browser-visible key should be revoked if it was exposed; removing a frontend header does not make that key private.
Preview only
preview_only is the hosted deployment's execution gate. It is not fixed by creating more keys, using a different subject, or completing a purchase preview. Read Preview availability for the current state.
Guest sessions are for exploring the console. They are not a substitute for durable production account access. Email delivery is still pending setup in this deployment, so an unavailable email flow should not be diagnosed as an adapter or API problem.
Wrong project or missing resource
A key chooses its owning project. Switching projects in the browser does not change a server's installed key. If a known job returns not_found, verify the key's project and the full job ID before assuming the job was deleted.
Subject names are case-sensitive and project-local. support in one project is not the same model memory as support in another. Compare the submitted subject with the intended server-side mapping.
Invalid request
For 422, check JSON syntax, content type, idempotency-key format, unknown fields, and endpoint-specific limits. An inference must end with a user message or a completed tool-result block. A learning passage must be at least 20 string-length units. Provider clients should use /v1/chat/completions; the native /v1/inferences endpoint has a different request shape.
Use the API reference rather than repeatedly changing unrelated settings. If the minimal valid request still fails, send the request ID and redacted request shape through the diagnostics procedure.