# CREDENTIAL_REQUIRED

This deployment requires a credential on every call and none was presented. HTTP 401. Obtain an evaluation credential with one POST, no sign-up, and retry.

The hosted service requires the `x-jaxon-credential` header on every scoped call, and the request had none. The remedy needs no person.

## The envelope

```json
{"ok": false,
 "error": {"code": "CREDENTIAL_REQUIRED",
           "message": "this deployment requires a credential on every call. Obtain an evaluation credential automatically with POST /v1/credentials/evaluation (no sign-up), then send it as the x-jaxon-credential header.",
           "docs": "https://docs.agents.jaxon.ai/errors/credential-required.md"},
 "versions": {"...": "..."}}
```

## The fix, without a human

```bash
curl -s -X POST https://agents.jaxon.ai/v1/credentials/evaluation
# -> {"ok": true, "credential": "<token, shown once>", "grade": "evaluation", ...}
```

Store the `credential` value (the service keeps only its hash and cannot show
it again) and send it as `x-jaxon-credential` on every call. The `dsail` Python
client does exactly this on a 401 — obtains, stores at
`~/.config/dsail/credential`, retries once.

## What an evaluation credential can do

Compile, check and fetch the prompt pack, capped per day and over its
lifetime, and it expires. Storage operations — saving a ruleset under a name,
recording an approval, adding a converter — need a **full** credential, issued
by Jaxon; asking with an evaluation credential answers
[`CREDENTIAL_SCOPE`](credential-scope.md).

The MCP door used by claude.ai and ChatGPT authenticates with OAuth instead and
never sees this code.

See also: [Quickstart: REST](../quickstart/rest.md), [Error codes](../reference/errors.md).