Free tools Windows power users keep installed
One-click scans. No signup required.
Start with the exact response, the identity flow, and the resource the agent is calling. A 401 usually means the credential is missing or unacceptable; a 403 usually means the request is authenticated but lacks permission. Check the server’s WWW-Authenticate challenge and provider-specific error before changing credentials or adding permissions.
What should you capture before changing anything?
Record enough context to identify which part of the request failed, but never log a usable credential. Capture:
As an Amazon Associate I earn from qualifying purchases.
- UTC timestamp, endpoint host and path, HTTP status, and the redacted response body.
- Authentication-related response headers, especially
WWW-Authenticate. - Agent runtime or SDK name and version, deployment environment, and identity flow.
- The target API or tool resource and the operation the agent attempted.
- Which component emitted the error: agent runtime, identity provider, API gateway, resource server, or tool host.
Redact access and refresh tokens, client secrets, private keys, authorization headers, and user data from logs and support tickets. RFC 6750 explains why bearer tokens require this care: anyone who possesses one can use it to access its associated resources.
Read the authentication challenge
Inspect WWW-Authenticate for its scheme, error, error_description, and any scope value. RFC 9110 describes how a server uses challenges when credentials are missing, invalid, or inadequate. RFC 6750 says a resource server should provide an error when authentication fails with a supplied bearer token, but services are not required to disclose detailed diagnostics. An absent or vague description does not prove that the credential is valid.
#1 Best Overall
- EVOLUTION AMD RYZEN AI MAX+ 395 MINI PC - GMKtec EVO-X2 is the next evolution in AI mini PC Ryzen Strix Halo series. Thanks to AMD Simultaneous Multithreading (SMT) the core-count is effectively doubled, to 32 threads. Ryzen AI Max+ 395 has 64 MB of L3 cache and can boost up to 5.1 GHz, depending on the workload. The Ryzen AI Max+ 395 is currently rated as the "most powerful x86 APU" on the market for AI computing.
- AI NPU with XDNA 2 ARCHITECTURE - Powered by 16 “Zen 5” CPU cores, 50+ peak AI TOPS XDNA 2 NPU and a truly massive integrated GPU driven by 40 AMD RDNA 3.5 CUs, the Ryzen AI MAX+ 395 is a transformative upgrade and delivers a significant performance boost over the competition. The Ryzen AI Max+ 395 excels in consumer AI workloads like the llama.cpp-powered application: LM Studio. Shaping up to be the must-have app for client LLM workloads, LM Studio allows users to locally run the latest language model without any technical knowledge required and unleash their creativity and productivity.
- AMD RADEON 8090S iGPU GAMING PC - The AMD Radeon RX 8060S offers all 40 CUs with up to 2.9 GHz graphics clock and uses the new RDNA 3.5 architecture. The powerful iGPU is positioned between an RTX 4060 and 4070 laptop GPU and therefore enables gaming in FHD at maximum details in most demanding games. The 8060S can also utilize the full 128GB pool, which is perfect for running LLMs such as Deepseek 70B Q8, which runs comfortably on this machine.
- EIGHT CHANNEL LPDDR5X - LPDDR5X is a new ground breaking memory small form factor installed on-board. With blazing speeds up to to 8000MT/s, it runs 1.5x faster than the DDR5 SODIMMs; 90% better performance over DDR5 SODIMMs in video conferencing and photo editing; 30% better performance in productivity apps; 12% better performance in digital content workloads.
- QUAD SCREEN 8K DISPLAY SUPPORT - EVO-X2 AI Mini PC support 4-screen 4K/8K output via HDMI 2.1 (8K@60Hz), DisplayPort 1.4 (4K@60Hz), and dual USB 4 40Gbps Transfer speed (supporting PD3.0/DP1.4/DATA). Ideal for gaming, video editing, and multitasking, it provides expansive and crisp multi-display support.
Why is my AI agent getting a 401 Unauthorized error?
A 401 commonly means the server did not receive an acceptable credential. For bearer authentication, RFC 6750 classifies expired, revoked, malformed, or otherwise invalid tokens as invalid_token, which normally maps to 401.
- Confirm the request actually sends the expected authorization credential, in the format the API accepts.
- Check the provider’s error detail and the challenge header for
invalid_tokenor another specific cause. - Verify the token’s issuer or authority, intended audience or resource, subject, expiry, and issue time where the provider exposes those claims.
- If the provider confirms that the token is expired or otherwise invalid, acquire a fresh token and retry once as a diagnostic.
A fresh token will not fix a wrong tenant, issuer, audience, or credential configuration. Tokens can be opaque rather than JWTs; do not assume they can be decoded locally. Use the identity provider’s supported diagnostic tools for opaque tokens.
Why does my agent get 403 Forbidden when calling an API?
A 403 commonly indicates that the server understood the request but the authenticated identity is not permitted to perform it. RFC 6750 defines insufficient_scope as having fewer privileges than the request requires; that bearer-token error normally maps to 403. RFC 9110 likewise says a server ought to return 403 when valid credentials are inadequate.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Compare the requested operation with the token’s granted delegated scope or application role.
- Confirm that the permission belongs to the API resource being called, not another API.
- Check whether the required administrator consent or delegated grant has actually been made.
- Verify the grant is attached to the correct application or agent identity and resource service principal.
Do not repeatedly reacquire the same token when the response indicates insufficient privileges. First establish whether the agent acts as itself or on behalf of a signed-in user: application permissions (often represented as app roles) and delegated permissions (scopes granted for user-context access) are different authorization models. Grant only the permissions required for the intended operation; broadening access without verifying the identity-to-resource mapping can conceal the actual fault.
Rank #2
- Built for Local AI Development: AMD Ryzen AI Halo is designed for local AI development and inference, featuring 128GB unified memory and support for up to 200B parameter models to build and run intensive AI workloads locally.
- 128GB Unified Memory: Features 128GB LPDDR5x unified memory at 8000 MT/s with 256 GB/s memory bandwidth, providing a shared memory pool across the CPU, GPU, and NPU to support larger AI models.
- AMD Ryzen AI Max+ 395 Processor: Features 16 cores, 32 threads, and Zen 5 architecture, paired with AMD Radeon 8060S integrated graphics featuring 40 RDNA 3.5 compute units and an AMD XDNA 2 NPU with up to 50 TOPS.
- Linux AI Developer Platform: Purpose-built for Linux-based AI development with full AMD ROCm software support and preloaded tools, models, and workflows optimized for local AI development.
- Compact, Connected Design: Includes a 2TB M.2 SSD, 10GbE LAN, Wi-Fi 7, Bluetooth 5.4, USB-C connectivity, and HDMI 2.1b.
How do I fix an invalid or expired access token?
First distinguish a token that has expired or been revoked from one that is valid but intended for a different API. A token’s validity at its issuer does not establish that a resource server will accept it.
- Expired or revoked: Follow the provider’s supported token-acquisition flow to obtain a current token, then retry once.
- Wrong audience or resource: Request a token for the API being called. A credential issued for one resource is not automatically valid for another.
- Wrong issuer, authority, or tenant: Compare the configured authority and tenant with the token’s issuer and the target resource’s expected identity configuration.
- Malformed or absent credential: Check how the running agent constructs and sends the authorization header, without printing the token itself.
- Opaque token: Use provider-supported diagnostics rather than trying to infer claims by treating it as a JWT.
Where claims are available, compare issuer, audience, subject, expiry, and issue time against the intended identity and resource. Interpret them in the context of the provider’s configuration; a decoded token alone does not prove that consent, application permissions, or resource-side policy are correct.
How do I give an AI agent the right OAuth scopes or permissions?
Identify the agent’s identity mode before changing a grant. Microsoft Entra’s autonomous-agent guidance distinguishes admin-granted application permissions from consent grants used when an agent operates with a user account. They are not interchangeable.
- Identify the exact API operation that is denied and the API resource that owns it.
- Determine whether the request uses application permissions for an agent acting as itself, or delegated permissions for an agent acting on behalf of a user.
- Compare the permission required by that operation with the scope or app role actually granted to the relevant identity.
- Check that any required administrator consent or delegated user grant exists on the correct application, agent identity, and resource service principal.
- Acquire a token through the corrected flow and confirm that it is for the target resource before retrying the operation.
An insufficient_scope challenge may identify a needed scope, but the API’s requirements and the identity provider’s grant model determine the valid correction. Do not assume a similarly named permission for a different resource is sufficient.
Rank #3
- EVOLUTION RYZEN AI MAX+ 395 MINI PC - GMKtec EVO-X2 is the next evolution in AI mini PC Ryzen Strix Halo series. Thanks to AMD Simultaneous Multithreading (SMT) the core-count is effectively doubled, to 32 threads. Ryzen AI Max+ 395 has 64 MB of L3 cache and can boost up to 5.1 GHz, depending on the workload. The Ryzen AI Max+ 395 is currently rated as the "most powerful x86 APU" on the market for AI computing.
- AI NPU with XDNA 2 ARCHITECTURE - Powered by 16 “Zen 5” CPU cores, 50+ peak AI TOPS XDNA 2 NPU and a truly massive integrated GPU driven by 40 AMD RDNA 3.5 CUs, the Ryzen AI MAX+ 395 is a transformative upgrade and delivers a significant performance boost over the competition. The Ryzen AI Max+ 395 excels in consumer AI workloads like the llama.cpp-powered application: LM Studio. Shaping up to be the must-have app for client LLM workloads, LM Studio allows users to locally run the latest language model without any technical knowledge required and unleash their creativity and productivity.
- AMD RADEON 8090S iGPU GAMING PC - The AMD Radeon RX 8060S offers all 40 CUs with up to 2.9 GHz graphics clock and uses the new RDNA 3.5 architecture. The powerful iGPU is positioned between an RTX 4060 and 4070 laptop GPU and therefore enables gaming in FHD at maximum details in most demanding games. The 8060S can also utilize the full 128GB pool, which is perfect for running LLMs such as Deepseek 70B Q8, which runs comfortably on this machine.
- EIGHT CHANNEL LPDDR5X - LPDDR5X is a new ground breaking memory small form factor installed on-board. With blazing speeds up to to 8000MT/s, it runs 1.5x faster than the DDR5 SODIMMs; 90% better performance over DDR5 SODIMMs in video conferencing and photo editing; 30% better performance in productivity apps; 12% better performance in digital content workloads.
- QUAD SCREEN 8K DISPLAY SUPPORT - EVO-X2 AI Mini PC support 4-screen 4K/8K output via HDMI 2.1 (8K@60Hz), DisplayPort 1.4 (4K@60Hz), and dual USB 4 40Gbps Transfer speed (supporting PD3.0/DP1.4/DATA). Ideal for gaming, video editing, and multitasking, it provides expansive and crisp multi-display support.
Is the agent using the intended authentication configuration?
Compare the configuration of the process that is failing with the intended identity flow. A local settings file may differ from the deployed runtime, and SDK fields and supported credential types vary by language, SDK version, and tenancy mode.
- Authentication type, client or application ID, tenant ID, and authority endpoint.
- Target resource or audience and the requested scopes.
- Where a client secret or certificate is loaded from, and whether that source is available to the deployed process.
- Whether the expected managed identity is attached to the host or client.
- For workload credentials, the token-file path and the identity that can read it.
- The exact named connection or credential identifier used by the SDK.
For example, Microsoft’s Python Agents SDK documentation specifies a connection named SERVICE_CONNECTION for its connection manager. The same documentation says managed identities require the host or client to run on Azure with an identity configured. These are SDK-specific details, not universal names or requirements; check the documentation for the language, version, and hosting mode in use. Verify that both the service resource and app registration are configured for the intended single-tenant or multitenant setup.
Why is workload identity federation rejecting my agent token?
Federation requires more than a valid external token. The configured identity provider must trust the token’s claims, and the service-account mapping or rule must be active, match the intended principal, and authorize the requested identity.
- Inspect the external token locally and compare
iss,aud,sub,exp,iat, and any provider-specific claims with the configured provider and mapping rule. - Confirm that the request selects the intended provider and service-account mapping.
- Check that the mapping is active, authorizes the target principal, and has exactly one matching rule.
- For the Azure examples in OpenAI’s federation guidance, verify the configured audience and identity attributes, and confirm that the expected managed identity or projected AKS service-account token is being exchanged.
Do not paste production tokens into third-party JWT inspection sites. OpenAI’s federation setup is provider-specific and may change; follow the current platform documentation for the configured identity provider.
How do I troubleshoot an MCP or agent tool authentication challenge?
First identify which protocol and component produced the challenge. Tool servers and hosts can impose resource-specific authentication requirements, so do not assume that an API token accepted elsewhere will work for the tool.
For Agent Host Protocol, the resource attached to a pushed bearer token must match a resource advertised in protected-resource metadata or in a live authentication challenge. Match the challenge’s resource and any required scopes, then acquire a token for that resource if needed. The protocol says expiresIn represents remaining lifetime when known, and scopes may be supplied to help resolve a required-scope challenge. An invalid token or unrecognized resource must produce a JSON-RPC error.
This protocol detail should not be assumed to describe every MCP implementation. For an MCP server or another tool host, use that implementation’s challenge and resource documentation. In either case, separate two questions: whether the token is acceptable to its issuer, and whether it is intended for the challenged tool resource.
What if the error is not a standard HTTP status?
Preserve the exact redacted error and identify its source before mapping it to an OAuth diagnosis. SDKs, gateways, identity providers, APIs, and tool hosts can expose different error formats. Microsoft’s Agents SDK error reference, for example, documents SDK-specific errors; a vendor code should not be called invalid_token or insufficient_scope unless the provider documents that mapping.
If the response has no useful status or detail, compare the failing request with the runtime’s credential configuration and trace where the request stopped: token acquisition, token exchange, gateway validation, resource authorization, or tool invocation. Ask for the provider, SDK language and version, deployment environment, identity flow, target resource, and redacted error before prescribing a provider-specific setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
