# 401 Unauthorized when using LiveKit Cloud Agents CLI after successful authentication

**URL:** <https://community.livekit.io/t/401-unauthorized-when-using-livekit-cloud-agents-cli-after-successful-authentication/2067>\
**Category:** Getting Started\
**Created:** [September 15, 2026, 6:46pm UTC](https://community.livekit.io/t/401-unauthorized-when-using-livekit-cloud-agents-cli-after-successful-authentication/2067 "2026-09-15T18:46:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua\_Mendoza](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/joshua_mendoza/32/2538_2.png) [@Joshua\_Mendoza](https://community.livekit.io/u/Joshua_Mendoza)\
**Post date:** [September 15, 2026, 6:46pm UTC](https://community.livekit.io/t/401-unauthorized-when-using-livekit-cloud-agents-cli-after-successful-authentication/2067/1 "2026-09-15T18:46:30Z")

</div>

Hi, I’m trying to deploy my first LiveKit Cloud Agent.

I’m using LiveKit CLI **2.18.6 on Windows**.

`lk cloud auth` completes successfully and shows:  
`Authenticated project [Jarvis]`

Normal project authentication appears to work. For example, `lk token create` successfully generates a room access token.

However, all Cloud Agent management commands fail with:  
`Error from intermediary with HTTP status code 401 "Unauthorized"`

I have reproduced this with:  
`lk agent list`  
`lk agent list --verbose`  
`lk agent create`

I also removed the project from the CLI, authenticated again, and created a fresh project alias (`jarvis2`). Authentication succeeded, but Cloud Agent commands still return the same 401.

The LiveKit Cloud dashboard shows the project normally, but no agents are deployed yet.

Could you please check whether Cloud Agents deployment/management is enabled and correctly authorized for my project/account, or whether there is an account-side permission issue?

I can provide additional diagnostic information if needed.

---

<div class="post-metadata">

**Author:** ![abidullahcs.uk](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@abidullahcs.uk](https://community.livekit.io/u/abidullahcs.uk)\
**Post date:** [September 15, 2026, 7:01pm UTC](https://community.livekit.io/t/401-unauthorized-when-using-livekit-cloud-agents-cli-after-successful-authentication/2067/2 "2026-09-15T19:01:13Z")

</div>

@Joshua_Mendoza Worth running lk room list before this gets escalated, because neither of your checks tests what you think.

lk token create never contacts the server. It builds the grants and calls at.ToJWT(), then prints. There’s no net/http or SDK client anywhere in that path, so it signs locally with whatever key and secret are in your config and succeeds identically whether those are valid, stale, or revoked.

lk cloud auth is also a separate path from the agent commands. Both lk agent list and lk agent create use Before: createAgentClient, which builds:

```auto
  agentsClient, err = cloudagents.New(
      cloudagents.WithProject(project.URL, project.APIKey, project.APISecret))

```

So agent commands authenticate with the stored project API key and secret, not the browser session. That’s how you get “Authenticated project [Jarvis]” alongside 401 on every lk agent call.

lk room list uses the same credentials but over the wire:

` roomClient = lksdk.NewRoomServiceClient(project.URL, project.APIKey, project.APISecret, ...)`

which separates the two cases:

- 401 as well - the stored key and secret are the problem, not anything agent-specific. Make a fresh pair in the dashboard and re-add the project.
- works - credentials are good and it really is agent-side, which is where staff visibility is needed.

Given you already re-authed and made a fresh alias, that second outcome would be the interesting one.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/system/32/26_2.png) [@system](https://community.livekit.io/u/system)\
**Post date:** [September 30, 2026, 7:01pm UTC](https://community.livekit.io/t/401-unauthorized-when-using-livekit-cloud-agents-cli-after-successful-authentication/2067/3 "2026-09-30T19:01:53Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.