Your credentials are invalid. Please log in again with `{cli

Error message

Your credentials are invalid. Please log in again with `{cli_name} login`.

What it means

The AuthManager emitted NeedsReauth for an interactive (non-API-key) session: the persisted OAuth credentials can no longer be refreshed — the refresh token expired or was revoked — so the only remedy is to log in again. Selected when the auth state is not API-key authenticated.

Source

Thrown at app/src/ai/agent_sdk/mod.rs:1709

        if dispatched {
            return;
        }
        match event {
            AuthManagerEvent::AuthComplete => {
                dispatched = true;
                if let Err(err) = dispatch_command(ctx, command.clone(), global_options.clone()) {
                    report_fatal_error(err, ctx);
                }
            }
            AuthManagerEvent::NeedsReauth => {
                dispatched = true;
                let auth_state = AuthStateProvider::handle(ctx).as_ref(ctx).get();
                let message = if auth_state.is_api_key_authenticated() {
                    "Your API key is invalid. Please provide a valid key via '--api-key' or the WARP_API_KEY environment variable.".to_string()
                } else {
                    format!("Your credentials are invalid. Please log in again with `{cli_name} login`.")
                };
                report_fatal_error(anyhow::anyhow!(message), ctx);
            }
            AuthManagerEvent::AuthFailed(err) => {
                dispatched = true;
                report_fatal_error(anyhow::anyhow!("Authentication failed: {err:#}"), ctx);
            }
            _ => {}
        }
    });

    // Trigger authentication - the subscription above will handle the result.
    AuthManager::handle(ctx).update(ctx, |auth_manager, ctx| match authentication {
        CommandAuthentication::PendingApiKey(api_key) => {
            auth_manager.authenticate_api_key(api_key, ctx);
        }
        CommandAuthentication::RefreshUser => auth_manager.refresh_user(ctx),
    });
}

View on GitHub (pinned to e72fd7aacb)

Solutions

Run `warp login` again to establish a fresh session
If login loops back to this error, run `warp logout` first, then log in
For headless environments, switch to WARP_API_KEY authentication instead of a session

Example fix

# before
warp agent list   # stale session -> credentials invalid

# after
warp logout || true
warp login
warp agent list

Defensive patterns

Strategy: try-catch

Try / catch

out=$(warp agent list 2>&1) || { case "$out" in
  *'credentials are invalid'*|*'not logged in'*) warp logout; warp login && warp agent list ;;
  *) echo "$out" >&2; exit 1 ;;
esac; }

Prevention

Prefer WARP_API_KEY for headless and long-lived automation
Re-login on a schedule shorter than the refresh-token lifetime
Wrap session-dependent jobs with a login-retry step

When it happens

Trigger: Running auth-required commands after the stored session's refresh token expired, after a password change, after revoking sessions from account security settings, or after the credential store was wiped.

Common situations: Long-lived local or CI sessions past the refresh-token lifetime; account security actions that invalidate sessions; switching accounts without logging out first.

Related errors

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/64a30b5539d849c1. Report an issue: GitHub.