Sign-in and Kit access

Use this page when login fails, the wrong account appears, or you are signed in but cannot install a Kit.

Check identity before access

ak whoami --json
ak licenses --json

Both commands perform the same live entitlement query. ak whoami foregrounds the active account; ak licenses presents the same per-Kit grants with Kit-focused wording. Account identity and a Kit grant are still distinct facts to verify.

An unauthenticated ak whoami --json result is not a command failure: it reports data.authenticated: false and exits 0. Read the payload instead of relying only on the exit code. If the account is correct but the Kit is absent from ak licenses, reinstalling cannot add the entitlement; use the account that received the Kit or contact support.

Sign in again

Email login starts an OTP flow:

ak login --email you@example.com

For a user API key from your web profile:

ak login --api-key ak_live_... --no-interactive

Never put a real API key in shell history, source control, screenshots, or a support bundle. API-key login stores the private key locally for reauthentication; protect it as a credential.

If the local CLI session is stale, clear only that session and sign in again:

ak logout
ak login --email you@example.com
ak whoami --json
ak licenses --json

ak logout is idempotent and exits 0 when no CLI session exists. It removes the local CLI credential first but preserves a paid App device session. For a renewable email session, remote revocation is best-effort; an unavailable registry does not leave the CLI locally signed in.

A legacy session without renewable credentials requires you to sign in again. The CLI recognizes this condition even when another error wraps the authentication failure and adds user-facing login guidance. It does not retry the operation or fall back to API-key login automatically; sign in, then rerun the command yourself. During an update, the original failure remains explicit alongside that guidance instead of being hidden.

API key rejected, or account has no Kit

ak login --api-key and API-key creation in your web profile return a specific error for each rejection reason. Match the response before changing anything.

Creating a key in your web profile can also be refused: only Kit owners — a direct purchase, a team seat, or a paid waitlist grant — can create one. An account whose only license is an App license sees "Kit License Required" (403 APP_LICENSE_NOT_ELIGIBLE) and should sign in with --license-key instead of creating an API key.

App activation is a different check

ak login --license-key ak_license_... --no-interactive activates an App device session. It does not replace the live Kit entitlement query used by ak licenses. A valid App license, a successful CLI sign-in, and access to a paid Kit are related account states, but one does not prove the others.

Network or registry errors

Run the network-aware health checks and then an offline comparison:

ak doctor --json
ak doctor --offline --json

If only the network-aware run fails, inspect proxy, DNS, TLS, and registry reachability. Do not switch channels or override the registry as a routine login fix. A stored-session or registry-query failure exits 1; invalid flags exit 2.

If it still fails

Export redacted evidence:

ak diagnostics export --json > agentkit-diagnostics.json

Review the file before sharing. Do not include the session file, OTP, API key, or license key.

Related pages

• Onboarding
• Kit installation problems
• Configuration problems