---
title: "MGS9021: invalid token request"
description: A mint asked for something no token can be, a grant holding tokens=write, an empty or unknown grant, a surface this door does not mint, or a name that looks like an id. Answered 400.
tags: [MGS9021, auth, token, mint, grant, "400"]
---

# MGS9021: invalid token request

A mint asked for a token that cannot exist, whoever asked.

```text
[MGS9021] auth: tokens=write is the operator's alone; no stored token holds it
  see: .../MGS9021.md
```

The same refusal comes from the CLI's create commands, the console's token
settings (`400`), and a link-code exchange whose body does not parse.

## Why

Each of these would make a token that breaks the grant model, so none is minted:

- **`tokens=write`.** Token management belongs to the operator token alone. A
  stored token holding it could mint anything, so not even the operator mints
  one.
- **An empty or unknown grant.** A token that reaches nothing, or a level a
  surface has no meaning for (`mcp=read`).
- **A surface this door does not mint.** The console mints console grants only;
  an `/mcp` token comes from `magus config mcp connector create`.
- **A name that looks like an id.** Eight hex digits are an id, and revoke takes
  an exact id or an exact name, so a name may not read as the other.

A grant past what the minter holds is [MGS9015](MGS9015.md), not this.

## Resolution

Ask for a grant a token can hold, from the door that mints it, under a name
that is not eight hex digits.

## See also

- [Tokens and grants](../../../concepts/tokens.md)