Troubleshoot an agent connection

Use this article when an AI agent cannot connect to your store, or connects and then cannot do what you asked. Start from the message you were shown rather than retrying, because each cause has its own fix and retrying changes none of them. To set a connection up in the first place, see Connect an AI agent to your store.

Most failures are one of three things: the token, the access behind it, or the address. The message tells you which.

The sign-in screen refuses the connection

The sign-in screen names what failed, above the store it was about to grant access to.

That token isn’t valid or is inactive

The token is wrong, has been turned off, or has passed its expiry. Reveal the current value again from Your agent access in the StoreConnect Console and check the state shown beside it. Disabling or resetting access replaces the token, so a copy saved earlier stops working once an administrator has done either. Paste the current value, not one from a password manager entry you have not updated since.

This user has no editing access to this store

The token is fine. Your user has no Store Role of type Content Changes covering the store at that address. Ask an administrator for one, at Editor level to stage changes or Approver level to publish them. See Store roles.

This message is about the store at the address you signed in at, not about every store. On a shared domain, a role that covers your store does not help if you signed in at another store’s path.

This client’s redirect address is not on this store’s allow list

Neither your token nor your access is the problem. The product you are connecting from is not one StoreConnect accepts a browser sign-in for yet, and the list is StoreConnect’s own configuration, so a store administrator cannot add to it. Email support@storeconnect.com with the product name and the address shown under the message.

This can happen with a product installed on your own machine. The sign-in is accepted only when it finishes on a local http address, such as http://127.0.0.1:33418/. If the address under the message starts with the product’s own name instead, such as cursor://, the product is using an app address, and that address needs adding like any other.

Meanwhile, the product can still connect by sending the bearer credential as a header. Copy it from Your stores in the Console rather than assembling it by hand.

This client asked to connect to a different endpoint than this store’s

The client is pointed at one store and signing in at another. The message names the address the store expects. Correct the address in the client and start the sign-in again.

The address names no store

An address that names no store fails before your token is ever checked. Every message here means the address, not your access. For how addresses are built when several stores share one domain, see the shared-domain section of Connect an AI agent to your store.

No store is configured at this address

The path is wrong, or the store at it is not live. Your store’s path is the Path field on its Store record (s_c__Store__c.s_c__Path__c), and it goes between the domain and /mcp. A store with nothing in that field is the one served at the root of the domain.

:::warning The Store URL shown in the Console leaves the path out, so on a shared domain it shows the root store’s address for every store in the list. Add your store’s path yourself before you connect. :::

Several stores share this domain and none is marked as the default

You used the domain with no path on it, and more than one store answers to that domain. Connect using your store’s own path, or ask your administrator to mark one store as the default.

Your store’s “page not found” page

Opening https://<your-store-domain>/.well-known/mcp.json and getting your store’s own “page not found” page means the store is on a version earlier than v22 and has no endpoint to connect to. Nothing is broken, and retrying will not change the outcome. Email support@storeconnect.com or ask your implementation partner about upgrading. The version check is in Connect an AI agent to your store.

The skills toolkit still works while you wait, because knowledge does not need a connection. See Install the StoreConnect AI skills.

The agent is connected but something does not work

The agent is connected but has no tools

The agent signs in and shows the connection as active, but lists no StoreConnect tools, or says the connector has no tools available. The Content Changes Store Role your user holds for that store has no API Scopes selected. A role with nothing selected grants nothing, and an agent is only shown the tools your scopes allow.

1. Ask an administrator to open the Content Changes store role assigned to you for that store and select the API Scopes you need. Check the role you are actually assigned, not another role that already has scopes. See Store roles.
2. Once the scopes are saved, follow the steps in A change to your access has not taken effect so your agent picks them up.

The agent cannot perform an action

If an agent cannot perform an action, it is usually a permissions boundary rather than a fault. The agent works as you, so it can only do what your Store Role allows, on the stores that role covers. Ask your administrator to review the access for that store instead of looking for a workaround.

The agent stopped working partway through

Sign-in sessions expire after about eight hours. When a session expires, sign in again from your agent using your existing token. You do not need a new token.

A change to your access has not taken effect

A session carries the permissions you had when you signed in. If your Store Role, the role’s API Scopes, or the stores it covers have changed, the agent keeps working with the old permissions until a new session starts. Some agents keep the session they already have when you sign in again, so start a new one:

1. Remove the StoreConnect connection from your agent.
2. Add it again and sign in with your existing token. You do not need a new token.

If your agent sends the bearer credential instead of signing in, the change applies on the next request, and there is nothing to do.

When the cause is fixed, the sign-in screen names your store and its address, you are prompted for your token, and your agent shows the connection as active.