2.13.0-beta.20). Features may change before the next stable release.Switch to stable →Troubleshooting
Sign-in and Kit access
Separate authentication from Kit entitlements, verify the active account, and renew credentials without exposing secrets.
Use this page when login fails, the wrong account appears, or you are signed in but cannot install a Kit.
Check identity before access
ak whoami --json
ak licenses --jsonBoth commands perform the same live entitlement query. ak whoami foregrounds
the active account; ak licenses presents the same per-Kit grants with
Kit-focused wording. Account identity and a Kit grant are still distinct facts
to verify.
An unauthenticated ak whoami --json result is not a command failure: it reports
data.authenticated: false and exits 0. Read the payload instead of relying only
on the exit code. If the account is correct but the Kit is absent from
ak licenses, reinstalling cannot add the entitlement; use the account that
received the Kit or contact support.
Sign in again
Email login starts an OTP flow:
ak login --email you@example.comFor a user API key from your web profile:
ak login --api-key ak_live_... --no-interactiveNever put a real API key in shell history, source control, screenshots, or a support bundle. API-key login stores the private key locally for reauthentication; protect it as a credential.
If the local CLI session is stale, clear only that session and sign in again:
ak logout
ak login --email you@example.com
ak whoami --json
ak licenses --jsonak logout is idempotent and exits 0 when no CLI session exists. It removes
the local CLI credential first but preserves a paid App device session. For a
renewable email session, remote revocation is best-effort; an unavailable
registry does not leave the CLI locally signed in.
A legacy session without renewable credentials requires you to sign in again. The CLI recognizes this condition even when another error wraps the authentication failure and adds user-facing login guidance. It does not retry the operation or fall back to API-key login automatically; sign in, then rerun the command yourself. During an update, the original failure remains explicit alongside that guidance instead of being hidden.
App activation is a different check
ak login --license-key ak_license_... --no-interactive activates an App device session. It
does not replace the live Kit entitlement query used by ak licenses. A valid
App license, a successful CLI sign-in, and access to a paid Kit are related
account states, but one does not prove the others.
Network or registry errors
Run the network-aware health checks and then an offline comparison:
ak doctor --json
ak doctor --offline --jsonIf only the network-aware run fails, inspect proxy, DNS, TLS, and registry
reachability. Do not switch channels or override the registry as a routine
login fix. A stored-session or registry-query failure exits 1; invalid flags
exit 2.
If it still fails
Export redacted evidence:
ak diagnostics export --json > agentkit-diagnostics.jsonReview the file before sharing. Do not include the session file, OTP, API key, or license key.