TL;DR: Run snyk auth in the codespace terminal and complete the browser login it prompts for, then confirm with snyk whoami. Fresh codespaces have no stored credentials, so the CLI has nothing to send and every API call fails auth. One completed login flow fixes it.

```text
authentication failed. please check the API token
```

1. Check the current auth state. Run `snyk whoami`.
Expected: if you see an auth error or no username, the codespace has no valid credentials stored. That is the whole problem.
2. Start the login flow. Run `snyk auth` in the codespace terminal.
Expected: the CLI prints a login URL. Open it in your browser, sign in to snyk, and approve the request, then return to the terminal.
3. Confirm the login stuck. Run `snyk whoami` again.
Expected: it prints your snyk username. The CLI has now stored credentials for this codespace.
4. Re-run your scan. Run `snyk test`.
Expected: the scan runs instead of failing on authentication.

## Use this when
- snyk test fails with an auth error in a new codespace or dev container
- you have never run snyk auth in this environment
- the same account works fine on your laptop but not in the codespace

## Not for this skill when
- snyk whoami already prints your username; the failure is then an org or project permission problem, not authentication
- the error is about a missing org or project; that is a different lookup problem
- you are running snyk in CI with a service account; that setup uses a stored credential by design, not the interactive flow

## Variant phrasings
### snyk auth not working in github codespaces
### snyk test says authentication failed in a new dev environment
### how to log in to snyk CLI inside a codespace
### snyk CLI has no credentials in a fresh codespace

## Why it happens
The snyk CLI stores its credential per machine, or per container filesystem. A fresh codespace is a brand-new filesystem with no stored credential, so the CLI sends an empty or missing credential and the API rejects it. The error message points at the API token because that is what the API saw missing, but the real gap is that the interactive login never ran in this environment.

## Edge cases
- Codespaces are ephemeral. If you rebuild the codespace, you run snyk auth again; consider whether your team wants the credential supplied as a codespace secret instead of an interactive login.
- If your snyk org enforces single sign-on, the browser flow must complete the SSO step too; a plain snyk login without SSO still fails against that org.
- A token from a different snyk account (personal vs work) authenticates fine but then fails on org access; make sure the browser session approving the flow is the right account.
- If the browser flow cannot complete because you have no browser access, create a token under your snyk account settings and enter it at the CLI prompt rather than pasting it into chat or logs.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N7fGHmjLOi5mPup7TdNeWw