401 Unauthorized when using LiveKit Cloud Agents CLI after successful authentication

Getting Started
1

Hi, I’m trying to deploy my first LiveKit Cloud Agent.

I’m using LiveKit CLI 2.18.6 on Windows.

lk cloud auth completes successfully and shows:
Authenticated project [Jarvis]

Normal project authentication appears to work. For example, lk token create successfully generates a room access token.

However, all Cloud Agent management commands fail with:
Error from intermediary with HTTP status code 401 "Unauthorized"

I have reproduced this with:
lk agent list
lk agent list --verbose
lk agent create

I also removed the project from the CLI, authenticated again, and created a fresh project alias (jarvis2). Authentication succeeded, but Cloud Agent commands still return the same 401.

The LiveKit Cloud dashboard shows the project normally, but no agents are deployed yet.

Could you please check whether Cloud Agents deployment/management is enabled and correctly authorized for my project/account, or whether there is an account-side permission issue?

I can provide additional diagnostic information if needed.

2

@Joshua_Mendoza Worth running lk room list before this gets escalated, because neither of your checks tests what you think.

lk token create never contacts the server. It builds the grants and calls at.ToJWT(), then prints. There’s no net/http or SDK client anywhere in that path, so it signs locally with whatever key and secret are in your config and succeeds identically whether those are valid, stale, or revoked.

lk cloud auth is also a separate path from the agent commands. Both lk agent list and lk agent create use Before: createAgentClient, which builds:

  agentsClient, err = cloudagents.New(
      cloudagents.WithProject(project.URL, project.APIKey, project.APISecret))

So agent commands authenticate with the stored project API key and secret, not the browser session. That’s how you get “Authenticated project [Jarvis]” alongside 401 on every lk agent call.

lk room list uses the same credentials but over the wire:

roomClient = lksdk.NewRoomServiceClient(project.URL, project.APIKey, project.APISecret, ...)

which separates the two cases:

  • 401 as well - the stored key and secret are the problem, not anything agent-specific. Make a fresh pair in the dashboard and re-add the project.
  • works - credentials are good and it really is agent-side, which is where staff visibility is needed.

Given you already re-authed and made a fresh alias, that second outcome would be the interesting one.