MGS9021: invalid token request

A mint asked for a token that cannot exist, whoever asked.

[MGS9021] auth: tokens=write is the operator's alone; no stored token holds it
  see: .../MGS9021.md

The same refusal comes from the CLI's create commands, the console's token settings (400), and a link-code exchange whose body does not parse.

Why

Each of these would make a token that breaks the grant model, so none is minted:

tokens=write. Token management belongs to the operator token alone. A stored token holding it could mint anything, so not even the operator mints one.
An empty or unknown grant. A token that reaches nothing, or a level a surface has no meaning for (mcp=read).
A surface this door does not mint. The console mints console grants only; an /mcp token comes from magus config mcp connector create.
A name that looks like an id. Eight hex digits are an id, and revoke takes an exact id or an exact name, so a name may not read as the other.

A grant past what the minter holds is MGS9015, not this.

Ask for a grant a token can hold, from the door that mints it, under a name that is not eight hex digits.