unable to get client settings: Error from intermediary with HTTP status code 401 "Unauthorized" when running lk agent deploy

Thanks for reaching out, Hari. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.

I'm trying to deploy to cloud using lk agent deploy. No proxies

Thanks — I’ll help you troubleshoot the 401 during

lk agent deploy

to LiveKit Cloud. Quick clarifying questions (these will pinpoint the auth failure): • Are you using the LiveKit Cloud API key + secret configured locally (e.g., via

LK_API_KEY

/

LK_API_SECRET

env vars or

lk

CLI config)? • Do you see any additional error output from

lk agent deploy

(full error text or stack trace)? Please paste a sanitized copy. • Does

lk whoami

or

lk config get

(if available) show the expected account/project? • Did you recently rotate the API key/secret or change permissions on the Cloud project? • Confirm you’re running the command from a network with direct internet access to LiveKit Cloud (you said no proxies — thanks). • If possible, run the deploy with verbose/debug output and paste the auth-related lines: ◦

lk agent deploy --verbose

or

LK_DEBUG=1 lk agent deploy

What I can do after you share those: confirm whether the CLI is sending the correct credentials, point out missing/incorrect env vars or config, and walk you through regenerating keys or reconfiguring the CLI to fix the 401.

lk whoami • No help topic for 'whoami'. hk

Thanks — I see

lk whoami

isn’t a valid command and you’re hitting a 401 with

lk agent deploy

. Let’s verify your CLI auth and project setup so we can fix the Unauthorized error. Please run these and share the outputs (sanitized): 1. Authenticate (if you haven’t):

lk cloud auth

1. List projects to confirm you’re logged in and which project is selected:

lk project list

1. From the directory where you run

lk agent deploy

, confirm the

livekit.toml

exists:

ls -la livekit.toml

1. Re-run the deploy with debug output and paste the auth-related lines/error:

LK_DEBUG=1 lk agent deploy

What I’ll check once you share those: whether your CLI is authenticated to Cloud, the selected project, and whether the agent config matches that project. If auth failed, I’ll guide you through re-authenticating or setting the correct default project. Sources: LiveKit CLI project management | LiveKit docs | Deploying to production | LiveKit Docs

How to switch projects?

You're asking how to switch projects in the

lk

CLI — here’s how. 1. List your projects:

lk project list

The current default is marked with

*

. 1. Set a different default:

lk project set-default <project-name>

Replace

<project-name>

with the name shown in

lk project list

. 1. Verify:

lk project list

After switching, retry your deploy:

LK_DEBUG=1 lk agent deploy

If you still get 401, run

lk cloud auth

to re-authenticate and then repeat the steps above. Sources: LiveKit CLI project management | LiveKit docs

lk project list ─╯ ┌───────────────┬──────────────────────────────────┬─────────────────┐ │ Name │ URL │ API Key │ ├───────────────┼──────────────────────────────────┼─────────────────┤ │ air │ wss://air-76v7fg9o.livekit.cloud │ API7uAXsANMReQk │ │ air-backend │ wss://air-76v7fg9o.livekit.cloud │ APIQ3YXaLwfRp2z │ │ * air-www │ wss://air-76v7fg9o.livekit.cloud │ APIpR7fWAsqPMNa │ └───────────────┴──────────────────────────────────┴─────────────────┘ This is my env local # LiveKit Configuration LIVEKIT_URL=wss://air-76v7fg9o.livekit.cloud LIVEKIT_API_KEY=APIDKUSxf8Tk9qX ╰─ LK_DEBUG=1 lk agent deploy ─╯ Using project [air] Using agent [CA_7m5deEZERfEX] unable to get client settings: Error from intermediary with HTTP status code 401 "Unauthorized"

Thanks — I see the problem: the CLI is using the "air" project but your local env has a different API key (

LIVEKIT_API_KEY=APIDKUSxf8Tk9qX

). That mismatch causes the 401 during

lk agent deploy

. Please do one of the following: Option A — Use the selected project’s credentials 1. Update your env to match the project shown by

lk project list

(for example use the

air

project API key/secret displayed by the CLI). 2. Remove any conflicting

LIVEKIT_API_KEY

/

LIVEKIT_API_SECRET

from your local env if you want the CLI to use the project credentials automatically. 3. Re-run:

LK_DEBUG=1 lk agent deploy

Option B — Switch the CLI project to match your env 1. Find the project name that corresponds to your current API key (from

lk project list

). 2. Set it as default:

lk project set-default <project-name>

1. Verify with

lk project list

, then retry deploy:

LK_DEBUG=1 lk agent deploy

If you don’t know the secret for the

air

API key or want to re-link the CLI, run:

lk cloud auth

and then confirm the default project with

lk project list

. Tell me which option you choose or paste the output of

lk project list

after any change and I’ll guide the next step. Sources: LiveKit CLI project management | LiveKit docs | Agents Framework | livekit/livekit_composite | DeepWiki

ive changed the default project and put the api keys for that project - im still getting te same error

Thanks — sorry this is still blocked. I’ll help narrow it down. Please share the following so I can pinpoint why the 401 persists: 1. Output of:

lk project list

1. Your

livekit.toml

(paste contents). 2. The values of these env vars (you can redact secrets but indicate length/format): •

LIVEKIT_URL

•

LIVEKIT_API_KEY

•

LIVEKIT_API_SECRET

1. Full debug output from the failing command:

LK_DEBUG=1 lk agent deploy

Also confirm: • You ran

lk cloud auth

after switching projects. • The API key/secret you set are for the same project shown as default in

lk project list

. Share those and I’ll point to the exact mismatch or next fix. Sources: server-sdk-ruby | livekit/livekit_composite | DeepWiki | LiveKit CLI project management | LiveKit docs

╰─ lk project list ─╯ ┌──────────────────┬──────────────────────────────────┬─────────────────┐ │ Name │ URL │ API Key │ ├──────────────────┼──────────────────────────────────┼─────────────────┤ │ air │ wss://air-76v7fg9o.livekit.cloud │ API7uAXsANMReQk │ │ air-backend │ wss://air-76v7fg9o.livekit.cloud │ APIQ3YXaLwfRp2z │ │ air-www │ wss://air-76v7fg9o.livekit.cloud │ APIpR7fWAsqPMNa │ │ * air-scheduling │ wss://air-76v7fg9o.livekit.cloud │ APIeymFiMG3YAft │ livekit/toml [project] subdomain = "air-76v7fg9o" [agent] id = "CA_7m5deEZERfEX" ╰─ LK_DEBUG=1 lk agent create ─╯ Using project [air] Creating new agent Using secrets file [.env.local] unable to get client settings: Error from intermediary with HTTP status code 401 "Unauthorized" LIVEKIT_URL=wss://air-76v7fg9o.livekit.cloud LIVEKIT_API_KEY=APIeymFiMG3YAft LIVEKIT_API_SECRET=

Thanks — I can see the problem: your

LIVEKIT_API_SECRET

is empty. The CLI needs both the correct API key and its matching API secret for the selected project to authenticate. Please do the following: 1. In the LiveKit Cloud console, copy the API Secret for the project marked

*

(air-scheduling). 2. In your

.env.local

(or environment), set both: ◦

LIVEKIT_API_KEY=APIeymFiMG3YAft

◦

LIVEKIT_API_SECRET=<the-secret-you-copied>

◦ Confirm

LIVEKIT_URL=<wss://air-76v7fg9o.livekit.cloud>

1. Ensure your default project is `air-scheduling`:

lk project set-default air-scheduling
   lk project list

1. Retry with debug:

LK_DEBUG=1 lk agent create

(or

lk agent deploy

if you already created the agent) If you still get 401, paste the

LK_DEBUG=1

auth lines (redact the secret) and I’ll help diagnose further.

The secret is not empty. ive removed it while sharing

Thanks — glad you clarified the secret was redacted. Next checks to pin down the 401 (please run and paste results or confirm): 1. Confirm project/credentials alignment • Run:

lk project list

— ensure the starred project is the one whose API key/secret you set in env. • Confirm

LIVEKIT_API_KEY

exactly matches that project's API Key. 1. Confirm agent belongs to that project • Run:

lk agent list

(shows agents the CLI can see). If it shows agents for a different project, the CLI context or credentials are still mismatched. 1. Re-authenticate CLI session • Run:

lk cloud auth

then

lk project list

to ensure CLI session is fresh and shows the expected default. 1. Re-run with debug and paste the auth block (redact secret) •

LK_DEBUG=1 lk agent create

(or

lk agent deploy

) — share the debug lines around "auth" / "client settings" so I can read the exact failure. If everything above looks correct but the 401 persists, tell me the outputs of steps 1–4 and I’ll point to the exact mismatch (agent vs. project vs. env).

the agent is not deployed yet. I have another agent running. I want to create a new one. But my auth is failing

Thanks — I hear you: you’re trying to create a new agent but auth keeps failing with 401. Let’s run a short, focused checklist to surface the exact mismatch. Please do these steps and paste the outputs (you can redact secrets): 1. Confirm CLI project and keys align

lk project list
echo "LIVEKIT_URL=$LIVEKIT_URL"
echo "LIVEKIT_API_KEY=$LIVEKIT_API_KEY"
echo "LIVEKIT_API_SECRET=${#LIVEKIT_API_SECRET} chars"

(We only need the API key value and the secret length to confirm they match the starred project.) 1. Ensure the CLI session is fresh

lk cloud auth
lk project list

1. Confirm the agent command sees the project

LK_DEBUG=1 lk agent create

Paste the debug lines around the auth/client settings failure (you can redact the secret). 1. If

lk agent create

still fails, run:

lk agent list

to show what agents the CLI can already see. What I’ll check once you send those: whether the starred project matches

LIVEKIT_API_KEY

, whether the CLI session is tied to the correct account, and the exact debug error so I can point to the precise cause (wrong key, missing secret, project mismatch, or token scope).

╰─ lk agent list ─╯ Using project [air] unable to list agents: Error from intermediary with HTTP status code 401 "Unauthorized"

Thanks — I know this is annoying. From the outputs, the CLI is still using the "air" project (not the starred "air-scheduling" you set), so the API key/secret the CLI sends likely don’t match the project it’s contacting — that causes the 401. Please run these steps exactly and paste the short outputs (you can redact secrets): 1. Set the desired default project:

lk project set-default air-scheduling
lk project list

Confirm the

*

is next to

air-scheduling

. 1. Re-authenticate the CLI session:

lk cloud auth
lk project list

Confirm

air-scheduling

remains starred. 1. Ensure env vars match the starred project (show key and secret length only):

echo "LIVEKIT_URL=$LIVEKIT_URL"
echo "LIVEKIT_API_KEY=$LIVEKIT_API_KEY"
echo "LIVEKIT_API_SECRET=${#LIVEKIT_API_SECRET} chars"

1. Try listing/creating the agent with debug and paste the auth/client error block:

LK_DEBUG=1 lk agent list
# or
LK_DEBUG=1 lk agent create

If after step 1–3 the starred project is correct and the key/secret match but you still get 401, paste the redacted debug auth block and I’ll point to the exact mismatch (wrong secret, stale CLI session, or project routing).