Troubleshooting

A stored profile doesn't take effect

AMP_TOKEN outranks every profile setting: --token > AMP_TOKEN > --profile > AMP_PROFILE > the active profile. If you've set AMP_TOKEN in your shell, whether intentionally or as a leftover export from a CI-style session, amp uses it even when you pass --profile or set AMP_PROFILE. Run amp auth status first; it reports the active credential's type, base URL, and expiry, and announces when AMP_TOKEN is in effect. Unset AMP_TOKEN if you want a stored profile to take over.

Commands fail with a scope error

amp auth login requests every scope the CLI can use by default, so an OAuth-authenticated profile should work immediately. A Personal Access Token, however, carries its own fixed set of scopes. If a command fails because the token lacks a required scope, check which command family you're using against the scopes it needs, refer to Authentication for the full table, and confirm the active credential's granted scopes with amp context or amp auth status.

Commands fail after changing --base-url or AMP_API_BASE_URL

A profile binds a credential to one environment's base URL, so one host may reject a credential from another host. If you've overridden --base-url to point at a local server or a different environment, confirm the target host is reachable and healthy (GET /health should return 200 with {"status":"ok"}), and that you're using a credential for that environment.

flags update --enabled false fails for deployment-less flags

This is a known issue: updating a flag's enabled state to false fails when the flag has no deployment. Avoid that path until Amplitude fixes it; create, get, update other fields, and archive still work as documented in the flags command reference.