# CREDENTIAL_INVALID

The credential presented is unknown, revoked or expired. HTTP 401. Replace it the way the first one was obtained.

A credential was sent, and the service does not recognise it: it was never issued here, it has been revoked, or an evaluation credential has passed its expiry.

## The envelope

```json
{"ok": false,
 "error": {"code": "CREDENTIAL_INVALID",
           "message": "credential expired",
           "docs": "https://docs.agents.jaxon.ai/errors/credential-invalid.md",
           "remedy": "this deployment requires a credential on every call. Obtain an evaluation credential automatically with POST /v1/credentials/evaluation (no sign-up), then send it as the x-jaxon-credential header."},
 "versions": {"...": "..."}}
```

## The fix

- **Evaluation credential expired.** Obtain a new one:
  `POST https://agents.jaxon.ai/v1/credentials/evaluation`, store the
  `credential` value, retry. The `dsail` client does this automatically.
- **Wrong deployment.** A credential is bound to the deployment that issued it.
  A token from a local `dsail/agent_api` container is not valid against
  `agents.jaxon.ai`, and the reverse.
- **Revoked.** A full credential revoked by Jaxon stays revoked; ask for a new
  one.
- **Header mangled.** The header is `x-jaxon-credential` with the token as its
  whole value — no `Bearer` prefix.

Rulesets saved under a full credential's namespace persist across a token
replacement when Jaxon rebinds the new credential to the same namespace.

See also: [`CREDENTIAL_REQUIRED`](credential-required.md), [Error codes](../reference/errors.md).