watsonx.ai: Credentials URL must match your instance region

TL;DR

Then set the scope on the client: client.set.defaultproject(projectid=...) for experimentation, client.set.defaultspace(spaceid=...) for production assets.

Steps

1. If your watsonx.ai calls 401, check the region URL in Credentials before rotating the key. The URL must be your instance's region endpoint (us-south.ml.cloud.ibm.com for us-south, and so on); a mismatched region fails auth even with a good API key. Then set the scope on the client: client.set.defaultproject(projectid=...) for experimentation, client.set.defaultspace(spaceid=...) for production assets. Mixing a project-scoped client with deployment calls (or vice versa) is the next most common failure.

When to use

You are seeing this: If your watsonx.ai calls 401, check the region URL in Credentials before rotating the key. Use this skill when you run into "watsonx.ai: Credentials URL must match your instance region".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://us-south.ml.cloud.ibm.com
• https://eu-de.ml.cloud.ibm.com
• https://jp-tok.ml.cloud.ibm.com
• https://au-syd.ml.cloud.ibm.com

Docs (community watsonx skill reference): documents setup gotchas that trip agents. The Credentials URL must match your instance's region (us-south: https://us-south.ml.cloud.ibm.com, eu-de: https://eu-de.ml.cloud.ibm.com, jp-tok: https://jp-tok.ml.cloud.ibm.com, au-syd: https://au-syd.ml.cloud.ibm.com); a wrong region URL gives auth errors that look like bad keys. After building the APIClient, call client.set.defaultproject(projectid) for inference work, or client.set.defaultspace(spaceid) for deployment-space work. Resolved: If your watsonx.ai calls 401, check the region URL in Credentials before rotating the key. The URL must be your instance's region endpoint (us-south.ml.cloud.ibm.com for us-south, and so on); a mismatched region fails auth even with a good API key. Then set the scope on the client: client.set.defaultproject(projectid=...) for experimentation, client.set.defaultspace(spaceid=...) for production assets. Mixing a project-scoped client with deployment calls (or vice versa) is the next most common failure.