You must be logged in to the server Kubernetes Origin: Platform & cloud Last updated 14 Oct 2026

error: You must be logged in to the server (Unauthorized)

The cluster rejected kubectl’s credentials — expired token, wrong kubeconfig user, or cloud IAM identity not allowed.

Exact message you may see You must be logged in to the servererror: You must be logged in to the server (Unauthorized)the server has asked for the client to provide credentials
Explore the map of this error Full error map →
Seen on: Kubernetes

Meaning

Unlike Forbidden (known user, no permission), Unauthorized means the API server doesn’t accept who you are at all. Cloud clusters use short-lived tokens from aws/gcloud/az; expired SSO sessions, the wrong AWS profile, or an IAM role missing from EKS access cause it.

Common causes

  • Expired cloud SSO session or token
  • Wrong AWS profile/role for EKS (not in aws-auth / access entries)
  • Rotated certificates or revoked service account token
  • kubeconfig pointing at another cluster’s user

⚡ Quick fix

  1. Refresh credentials (aws sso login, gcloud auth login, az login) and regenerate kubeconfig
  2. Check which identity you use (aws sts get-caller-identity)
  3. Ensure that identity is mapped in the cluster

Detailed fix by platform

AWS

  1. bash
    aws sso login --profile prod
aws eks update-kubeconfig --name my-cluster --profile prod
kubectl get nodes

GCP

  1. gcloud container clusters get-credentials my-cluster --region us-central1

How to diagnose

  1. Context — kubectl config current-context
  2. Identity — Cloud caller identity
  3. Mapping — EKS access entry/aws-auth

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

AADSTS50126 — AADSTS50126: Error validating credentials due to invalid username or password (Azure)AADSTS50126AlreadyExists — Error from server (AlreadyExists): ... already exists (Kubernetes)AlreadyExistsauth/invalid-credential — Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) (Authentication)auth/invalid-credenti…bad auth : Authentication failed — MongoDB: MongoServerError: bad auth : Authentication failed (code 8000 / 18) (MongoDB)bad auth : Authentica…Could not load the default credentials — Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started (Google Cloud / Firebase)Could not load the de…DefaultAzureCredential failed — DefaultAzureCredential failed to retrieve a token from the included credentials / ManagedIdentityCredential authentication unavailable (Azure)DefaultAzureCredentia…ExpiredToken — AWS: ExpiredToken — The security token included in the request is expired (AWS)ExpiredTokenForbidden — Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace (Kubernetes)ForbiddenYou must …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.