---
name: hs-crypto-troubleshooting-unauthorized-token
title: Why am I not authorized when running TKE CLI plug-in commands?
description: You receive an error message after you run a `tke` CLI command.
last-updated: 2026-07-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why am I not authorized when running TKE CLI plug-in commands?
{: #troubleshoot-unauthorized-token}

IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted.
{: deprecated}
{: troubleshoot}
{: support}

You receive an error message after you run a `tke` CLI command.
{: shortdesc}

The message might be similar to the following one:
{: tsSymptoms}

> ibmcloud tke cryptounits
> FAILED
> Error querying service instances.
> Status code: 401
> Message: Unauthorized
> Your access token is invalid, expired, or does not have the necessary permissions to access this instance.

To run TKE CLI plug-in commands that send requests to the IBM Cloud, you must have a valid authentication token. An authentication token is created when you log in to the IBM Cloud, but it expires after 1 hour. After 1 hour, you must log in again to continue to send requests to the IBM Cloud.
{: tsCauses}

Log in to IBM Cloud again with the `ibmcloud login` command to refresh the token.
{: tsResolve}