---
title: "MGS9017: token store predates grants"
description: A stored token was written before tokens carried grants, in the retired connectors.d or as a version 1 record. Remove each file named and mint its replacement.
tags: [MGS9017, auth, connector, console, token, store, upgrade]
---

# MGS9017: token store predates grants

The token store found a token written by an older magus: a file under the
retired `$XDG_STATE_HOME/magus/connectors.d` (or `connectors.json`), or a
version 1 record in `tokens.d`. A retired directory stops listing, minting and
revoking with this error until its files are gone, and its tokens do not verify.
A version 1 record inside `tokens.d` is one bad file: it is skipped with this
code, and every other token keeps working, as [MGS9019](MGS9019.md) describes.

```text
[MGS9017] auth: 1 token file(s) predate grants and are refused:
/path/connectors.d/obsidian.json; remove each (`rm <file>`) and mint its
replacement with `magus config mcp connector create --name <name>` or
`magus config console token create --name <name>`
  see: .../MGS9017.md
```

## Why

An old record says which surface a token reached, not what it may do, and there
is no record of who minted it to check a translated grant against. Magus
re-mints rather than guesses. The operator token is unaffected: it never opens
the store.

## Resolution

For each file the message names, note the token's name, remove the file, and
mint a replacement of the same kind:

```sh
rm <file>
magus config mcp connector create --name <name>      # an MCP client
magus config console token create --name <name>      # a browser
```

Give each client its new token. A token the old record described no longer
authenticates.

## See also

- [Tokens and grants](../../../concepts/tokens.md)