---
title: Troubleshooting
description: "Diagnose amp CLI authentication and scope errors, credential-precedence surprises, and a known feature-flag update limitation."
product: general
token_estimate: 530
---
# Troubleshooting

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

## A stored profile doesn't take effect

`AMP_TOKEN` outranks every profile setting: `--token` > `AMP_TOKEN` > `--profile` > `AMP_PROFILE` > the active profile. If you've set `AMP_TOKEN` in your shell, whether intentionally or as a leftover export from a CI-style session, `amp` uses it even when you pass `--profile` or set `AMP_PROFILE`. Run `amp auth status` first; it reports the active credential's type, base URL, and expiry, and announces when `AMP_TOKEN` is in effect. Unset `AMP_TOKEN` if you want a stored profile to take over.

## Commands fail with a scope error

`amp auth login` requests every scope the CLI can use by default, so an OAuth-authenticated profile should work immediately. A Personal Access Token, however, carries its own fixed set of scopes. If a command fails because the token lacks a required scope, check which command family you're using against the scopes it needs, refer to [Authentication](https://amplitude.com/docs/developers/cli/authentication#required-scopes) for the full table, and confirm the active credential's granted scopes with `amp context` or `amp auth status`.

## Commands fail after changing `--base-url` or `AMP_API_BASE_URL`

A profile binds a credential to one environment's base URL, so one host may reject a credential from another host. If you've overridden `--base-url` to point at a local server or a different environment, confirm the target host is reachable and healthy (`GET /health` should return `200` with `{"status":"ok"}`), and that you're using a credential for that environment.

## `flags update --enabled false` fails for deployment-less flags

This is a known issue: updating a flag's `enabled` state to `false` fails when the flag has no deployment. Avoid that path until Amplitude fixes it; create, get, update other fields, and archive still work as documented in the [`flags` command reference](https://amplitude.com/docs/developers/cli/commands/flags).