{"record":{"id":"28252053991bfff3","repo":"NousResearch/hermes-agent","slug":"management-api-rejected-our-key-401-the-runnin","errorCode":null,"errorMessage":"management API rejected our key (401).  The running daemon was started with a different management.token — run `hermes egress restart`.","messagePattern":"management API rejected our key \\(401\\)\\.  The running daemon was started with a different management\\.token — run `hermes egress restart`\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":401,"severity":"warning","filePath":"agent/proxy_sources/iron_proxy.py","lineNumber":977,"sourceCode":"        with urllib.request.urlopen(req, timeout=_MGMT_RELOAD_TIMEOUT) as resp:\n            if resp.status == 200:\n                return True\n            raise RuntimeError(\n                f\"management API returned unexpected status {resp.status}\"\n            )\n    except urllib.error.HTTPError as exc:\n        body = \"\"\n        try:\n            body = exc.read().decode(\"utf-8\", errors=\"replace\")[:500]\n        except OSError:\n            pass\n        if exc.code == 422:\n            raise RuntimeError(\n                f\"iron-proxy rejected the new config (validation failed; \"\n                f\"the running ruleset is unchanged): {body}\"\n            ) from exc\n        if exc.code == 401:\n            raise RuntimeError(\n                \"management API rejected our key (401).  The running \"\n                \"daemon was started with a different management.token — \"\n                \"run `hermes egress restart`.\"\n            ) from exc\n        raise RuntimeError(\n            f\"management reload failed (HTTP {exc.code}): {body}\"\n        ) from exc\n    except (urllib.error.URLError, OSError) as exc:\n        # A daemon started from a pre-management config is alive but has\n        # no listener on the management port.\n        raise RuntimeError(\n            f\"could not reach the management API at {host}:{port} ({exc}).  \"\n            \"If the daemon was started before reload support, run \"\n            \"`hermes egress restart` once.\"\n        ) from exc\n\n\ndef _default_http_listen(tunnel_port: int) -> List[str]:","sourceCodeStart":959,"sourceCodeEnd":995,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/agent/proxy_sources/iron_proxy.py#L959-L995","documentation":"reload_proxy() authenticates to /v1/reload with the management.token from the on-disk config. HTTP 401 means the running daemon was started with a different token — most commonly because setup regenerated the token after the daemon was last started. The daemon's token can't be hot-swapped, so the fix is a restart under the current config.","triggerScenarios":"reload_proxy() / `hermes egress reload` after re-running `hermes egress setup` (which rotates management.token) without restarting the daemon; or two configs / two state dirs where the daemon was started from a different one.","commonSituations":"Re-running setup to change rules and forgetting restart; running multiple profiles whose proxy state dirs got crossed; manually starting the daemon with an explicit config_path and later reloading with the default config.","solutions":["Run `hermes egress restart` so the daemon starts with the current management.token, then reload future changes normally.","Make it a habit: after any `hermes egress setup`, restart once before relying on reload.","If using custom config_path, make sure you reload the same config the daemon was started with."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    reload_proxy()\nexcept RuntimeError as e:\n    if \"401\" in str(e):\n        # token rotated since daemon start — one restart re-syncs it\n        raise","preventionTips":["Pair every `hermes egress setup` with a restart before subsequent reloads.","Don't run the daemon from one config/state dir while reloading against another."],"tags":["auth","daemon","config","iron-proxy"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}