multica-ai/multica · error

not authenticated: run %s first

Error message

not authenticated: run %s first

What it means

Daemon.resolveAuth loads the CLI config for the active profile and found an empty token: the user never logged in for that profile (or the config file has no token). The error tells you the exact command to run — plain 'multica login' or 'multica login --profile <name>' — and the daemon also logs a warning at startup. The daemon refuses to operate unauthenticated.

Source

Thrown at server/internal/daemon/daemon.go:2052

		d.logger.Warn("failed to deregister runtimes on shutdown", "error", err)
	} else {
		d.logger.Info("deregistered runtimes", "count", len(runtimeIDs))
	}
}

// resolveAuth loads the auth token from the CLI config for the active profile.
func (d *Daemon) resolveAuth() error {
	cfg, err := cli.LoadCLIConfigForProfile(d.cfg.Profile)
	if err != nil {
		return fmt.Errorf("load CLI config: %w", err)
	}
	if cfg.Token == "" {
		loginHint := "'multica login'"
		if d.cfg.Profile != "" {
			loginHint = fmt.Sprintf("'multica login --profile %s'", d.cfg.Profile)
		}
		d.logger.Warn("not authenticated — run " + loginHint + " to authenticate, then restart the daemon")
		return fmt.Errorf("not authenticated: run %s first", loginHint)
	}
	d.client.SetToken(cfg.Token)
	d.logger.Info("authenticated")
	d.logger.Debug("auth token loaded", "profile", d.cfg.Profile, "token_len", len(cfg.Token))
	return nil
}

// allRuntimeIDs returns all runtime IDs across all watched workspaces.
func (d *Daemon) allRuntimeIDs() []string {
	d.mu.Lock()
	defer d.mu.Unlock()
	var ids []string
	for _, ws := range d.workspaces {
		ids = append(ids, ws.runtimeIDs...)
	}
	return ids
}

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Run 'multica login' (or 'multica login --profile <profile>') in the same user account the daemon runs as
2. Restart the daemon after login — the token is read once at startup
3. In containers/CI, mount or copy the CLI config with the token instead of interactive login

Example fix

# before
$ multica --profile work daemon
ERROR: not authenticated: run 'multica login --profile work' first

# after
$ multica login --profile work
$ multica --profile work daemon

// Pre-flight auth check before starting long-running work.
cfg, err := cli.LoadCLIConfigForProfile(profile)
if err != nil {
    return fmt.Errorf("load CLI config: %w", err)
}
if cfg.Token == "" {
    if profile != "" {
        return fmt.Errorf("run 'multica login --profile %s' first", profile)
    }
    return fmt.Errorf("run 'multica login' first")
}

Detect via strings.HasPrefix(err.Error(), "not authenticated:") (or a typed sentinel) at daemon startup and route to a login prompt instead of crash-looping; the daemon will not recover without user action.

When it happens

Trigger: Starting the daemon before ever logging in, or starting it with --profile work when only the default profile has a token. Also after wiping ~/.multica (or wherever the CLI config lives) or logging out.

Common situations: Fresh installs, switching to a new --profile without logging in for it, CI/container images missing the auth config file, and users who logged out or rotated configs.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• daemon exited during startup.
• could not start the local login callback server (used to rec
• failed to generate state: %w
• local server error: %w
• timed out waiting for authentication

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/b93be5559ee0b149. Report an issue: GitHub.