---
title: "MGS9015: grant below the route's need"
description: A valid bearer token was presented to a server route that needs more than the token's grant holds, answered 403 naming the need.
tags: [MGS9015, auth, token, grant, need, "403"]
---

# MGS9015: grant below the route's need

The token is valid, and it may not use this route. Every server route needs one
level on one surface (`mcp=write`, `console=read`, `tokens=write`), and the
token's grant is below it, so the server answered `403 forbidden`.

```text
[MGS9015] this route needs mcp=write and the token presented holds
console=write; mint one that reaches it with: magus config console token
create, or magus config mcp connector create
  see: .../MGS9015.md
```

## Why

A token holds a grant, one level per surface, and each route declares what it
needs. A console token is refused at `/mcp`, a connector token by the console,
a viewer by every console write, and every token but the operator's by token
management. The answer is 403 rather than 401 because the token is fine; it
only tells its holder that their own token is valid, which they already know.

An MCP tool call is held to `mcp=write` as well, over the server's `/mcp` and
over `magus mcp`'s stdio, and a call below it gets this code as a tool error
naming the tool.

## Resolution

Use a token whose grant covers the route. The message names the need:

- `mcp=write`: `magus config mcp connector create`
- `console=write`: `magus config console token create`
- `console=read`: `magus config console token create --viewer`
- `tokens=write`: only the operator token, used from your own shell

## See also

- [Tokens and grants](../../../concepts/tokens.md)