Skip to content
myosicam.us

Agent Install Token Rejected (HTTP 401)

Symptom

After you trigger an agent install from the panel, the agent binary is deployed to the server and starts, but it immediately fails to register with the panel. The systemd journal shows repeated 401 failures, and the service enters a restart loop:

[agent] Starting OSCam agent version=20260510-102141
[agent] Config loaded from /opt/oscam-agent/config.json
[agent] Install token found, registering with panel at https://panel.example.com...
[agent] Install-register attempt 1/3 failed: install token rejected by panel (HTTP 401)
[agent] Retrying in 5s...
[agent] Install-register attempt 2/3 failed: install token rejected by panel (HTTP 401)
[agent] Retrying in 5s...
[agent] Install-register attempt 3/3 failed: install token rejected by panel (HTTP 401)
[agent] FATAL: install registration failed: registration: all 3 install-register attempts exhausted: install token rejected by panel
oscam-agent.service: Failed with result 'exit-code'.

Visible effects in the panel:

  • The agent status column shows Unknown (the agent never reaches the heartbeat phase).
  • The Scan OScam and Restart action buttons remain disabled for that server.

How to confirm this is the issue

On the OScam server, read the agent journal:

Terminal window
journalctl -u myosicam-agent -n 100 --no-pager

Look for the install token rejected by panel (HTTP 401) line. If it appears, you are hitting this known issue.

Also check the service restart loop:

Terminal window
systemctl status myosicam-agent

If the Active: line cycles through activating → failed → activating every few seconds, the agent is looping.

Known causes

Install tokens are short-lived and single-use. A 401 can happen for several reasons:

CauseDescription
Token already consumedA previous install attempt on the same VPS used the token. The agent config still carries the spent value.
Token expiredThe token’s validity window passed before the agent first booted (can happen if there was a delay between triggering the install and the agent starting).
Token not persisted on the panelIn some cases the panel may fail to record the token before deploying the agent, so the panel has nothing to match against.
Wrong panel URLThe agent’s config.json contains a panel URL that does not match the panel that issued the token (e.g., a leftover config from a previous install).

Step 1 — Stop the restart loop

Terminal window
sudo systemctl stop myosicam-agent
sudo systemctl disable myosicam-agent

This prevents the service from consuming resources while you resolve the token issue.

Step 2 — Re-issue a fresh install token from the panel

The most reliable fix is to trigger a new agent install from the panel UI, which generates a fresh, unexpired, unconsumed token:

  1. Log into your panel.
  2. Navigate to Servers (or Agents) in the sidebar.
  3. Find the affected server entry.
  4. Click Re-install (or Install Agent if the server entry was removed).
  5. Re-enter the SSH credentials and click Install.

The panel generates a new token, re-deploys the agent binary, and passes the new token to the fresh agent instance.

Step 3 — Verify the server clock is in sync

Token expiry checks are time-sensitive. If the OScam server’s clock is skewed by more than a few minutes relative to the panel server, even a freshly-issued token may be rejected immediately.

Check the clock on the OScam server:

Terminal window
timedatectl status

If System clock synchronized: no or the time is visibly off, sync it:

Terminal window
sudo timedatectl set-ntp true

If the problem persists

If a fresh install with a newly-issued token still fails with 401:

  1. Note the agent version shown in the journal (version= line in the log above).
  2. Capture the full journal from the new install attempt:
    Terminal window
    journalctl -u myosicam-agent --since "10 minutes ago" --no-pager
  3. Contact support at contact us via myosicam.us with the journal output. Include your panel URL and the agent version string.

The engineering team will use the journal and panel-side logs to diagnose whether this is a token-shape mismatch between the agent binary version and the panel’s expected format — a deeper investigation is required for that class of failure.