Authentication or access is failing

Use the HTTP status or CLI error to separate credential, scope, project, and resource problems.

401: the credential was not accepted

1. Confirm the key begins with tm_ and was copied without quotes or whitespace.
2. Confirm it has not expired or been revoked in Settings → Access.
3. Send one supported authentication header, not several competing values.
4. Confirm the client is pointed at https://api.teml.io.
5. For CLI browser login, run teml login again and then teml whoami.

If a key was exposed, revoke it instead of testing it further.

403: the principal is authenticated but not allowed

Read the failed operation, then add only the exact required scope. MCP writes require mcp:write and the relevant domain permission. Some organization configuration and destructive scopes can only be granted by an owner or admin.

Do not fix a 403 by replacing a narrow automation key with a human administrator key.

404: verify project and tenant context

A resource outside the authenticated organization or project can appear missing. Confirm the dashboard project, CLI project (teml projects use <slug>), and key project restriction. Do not try to widen a project-scoped key with a project_id query parameter.

Dashboard sign-in loops

Retry in a normal browser window with cookies enabled for app.teml.io. If the workspace was just provisioned, confirm the invited email matches the identity provider account. Capture the exact time and visible error without including session cookies.

• Authentication and API keys
• Permission scopes