FAQ

Requests are unauthorized

Every /api/v1 route needs a Bearer credential - a JWT or an axl_key_… API key:

curl -s "$AXL_HOST/api/v1/models" -H "Authorization: Bearer $TOKEN"

When a credential is present and still rejected, the mismatch is usually one of:

  • Issuer or audience. The token was minted for a different deployment or a different audience than this server expects.
  • Key. Signing keys rotated, or the server trusts a different set.
  • Downstream scope. For delegated access, the failure can come from the downstream exchange rather than from AXL - the caller is authenticated, but the OBO scope is missing. See Reach services as the user.

Never put user tokens in agent configuration or documentation builds. In the docs playground, supply a short-lived development credential only.

Next

  • Authenticate callers - the flows and which client uses which.
  • - issuers, audiences, keys.

Agent forgets between sessions

Something a user told the agent earlier is gone in the next conversation.

Generated files disappear

Output the agent produced cannot be found later.

On this page

Next