## TL;DR

The CLI cannot fetch when it is pointed at the wrong project or config, or its token lacks access. Verify the selected project and config, re-authenticate, and confirm the token's scope covers the environment.

## Error

```text
"doppler: could not fetch secrets" cli error
```

## Steps

1. Run the CLI's project/config check to see what it thinks is selected. Expected: the intended project and config names.
2. If wrong, set them explicitly for the directory or pass them as flags. Expected: the selection matches the dashboard.
3. Re-authenticate the CLI to refresh the token. Expected: a fresh token.
4. Check the token scope covers the environment you are fetching. Expected: scope includes it.
5. Retry the fetch. Expected: secrets return.

## When to use

- Doppler CLI fetch failures in terminal or CI.
- After renames or environment changes.

## When not to use

- Dashboard or API issues unrelated to the CLI.
- Secrets exist but have wrong values (data issue, not fetch).

## Tool compatibility

- Doppler CLI; project/config scoping.

## Variant phrasings

### doppler could not retrieve secrets

Same triage.

### doppler unauthorized fetching secrets

Token or scope.

## Why it happens

The CLI resolves project and config from local state that drifts after renames, and tokens are scoped per environment.

## Edge cases

- Service tokens are per-config; a token for dev cannot read prod.
- Network egress rules can block the CLI while the dashboard works.
- Stale CLI versions fail against newer APIs; update the CLI.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IXvRoFSY4IjliZtXGELODw