Authentication and scope failures - Praxa

Keep credentials inside their owning surface. Execution Fabric uses a personal workspace API key. Integration Gateway calls use a short-lived delegated OAuth token. Memory federation receives provider clients that your backend already owns. None of these credentials are interchangeable.

Symptom	Likely cause	Next check
Authentication challenge	Missing, malformed, expired, or revoked credential	Confirm the credential type and issuer without logging the value.
Insufficient scope	The credential is valid but lacks the operation scope	Compare the route to its documented scope.
Organization memory key refused	Hosted memory scopes are personal-workspace only	Select personal intentionally or remove the memory scope.
SDK rejects the base URL	URL is not HTTPS or contains embedded credentials	Supply a clean HTTPS Gateway origin.
Package import works but runtime call fails	Package availability does not provide a Gateway or token	Obtain the deployment-specific origin and delegated OAuth token.
Provider memory query fails	Provider client or namespace mapping is invalid	Test the provider client independently in the backend.

Do not “fix” this by

Reusing an Execution Fabric key as an Integration Gateway token.
Sending a provider credential to Praxa.
Broadening every key to every available scope.
Silently changing the selected organization to personal.
Retrying a denied mutation with a new idempotency key.

Last modified on August 14, 2026