401 and 403: authentication and scope errors

These two look similar and mean completely different things. Getting the distinction right saves a lot of debugging.

401 Unauthorized

The key was not accepted. The request never reached a permission check.

The key was truncated on copy. Keys start with ag_live_ and are shown once at creation.
The key was revoked. Revocation is immediate, so the very next request fails.
No key was sent at all. Check the header is exactly Authorization: Bearer <key>.
An old key is still in the environment. ARGORANT_API_KEY takes precedence over anything saved by argorant login.

Fix: create a fresh key under Profile, API keys, and confirm with npx argorant whoami. The CLI exits with code 2 on 401.

403 Forbidden

The key is valid but lacks the scope for what you asked. This is by design: keys can be created without spending scopes so a research agent physically cannot reveal or export.

Check the scope list returned by GET /api/mcp/account.
If an agent should be read-only, a 403 on reveal is the system working correctly. Do not widen the key, narrow the agent.
Campaign commands are a separate surface that needs an operator-level key. A normal customer key gets 401 or 403 there, and that is expected.

Terminal showing a rejected key followed by a successful whoami

The CLI exits with code 3 on 403, so an agent can tell a missing permission apart from a broken credential without parsing any text.