Compute refused your call for authentication

The call was refused before anything ran

You sent a quote, a run, or a management call, and it came back refused. The message names authentication or a missing scope.

Nothing was admitted, so no work started. This is a safe state with a named next action.

Check the account, the actor and the scope

Read the response envelope rather than the client wrapper around it. The envelope carries a request ID, the operation, a typed state, and a structured next action.

Then answer three questions in order.

1. Which account or project was selected for this call?
2. Which identity signed it: your personal identity, a service identity, or an automation identity?
3. Which scope did the operation need, and does that identity hold it?

A key that works in one project often fails in another. The selected account is part of the answer, not only the key.

Then do this

Compute has two API families, and the fix depends on which one you were calling.

• Missing work scope: the identity is right but too narrow. Rotate it with the scopes the operation needs, or use one that already holds them.
• Missing management scope: organization, member, identity, source, destination, finance and audit operations belong to the Management API. Use a portal session, or a separately admitted management service identity. Management scopes are never mintable on a work key.
• Expired or revoked key: rotate it through identity and key management. The plaintext value is shown once only, so store it where your client reads it.
• Wrong account selected: reselect the project and send the call again unchanged.

What not to repeat

Never paste a key into a chat message, a ticket, or a shared document. Support never needs it, and a key that has been shared has to be rotated.

Never mint a broader key to get past a refusal. Widening access to fix a scope error leaves that access in place long after the error is gone.

Get help safely

Send the request ID, the operation name, and the safe error code. Add your client version, the contract release, and the time with its time zone.

Leave out payloads, key values, signed URLs, and banking information.