The toast on Swarme's login form is a CSRF failure, not a catalog outage. The exact copy is Your secure form token expired. Please go back and try again. That sentence is the product's instruction. Follow it. Do not treat it as a 422 field rule, a describe_only block, or a missing tool.
A parallel failure exists on the machine path. An unauthenticated quote returns HTTP 419 and the message Your secure request token expired. An unauthenticated GET /api/account/balance returns HTTP 401. Keep those three outcomes separate in logs: the form toast, 419, and 401.
What the toast is, and what it is not
The login form uses a secure form token. When that token expires, the toast appears. Reload the page and submit once from the fresh form. The login entry point is https://swarme.io/login, which resolves to /en/login. The form offers Google at /auth/google and email/password. This walkthrough does not claim a completed Google callback. It records the toast on the form that was actually submitted.
This toast is not a UUID defect, a 422 field rule, the 404 on /dashboard/developers, SSL EOF during a crawl, or proof that 1491 describe_only tools cannot be described.
A completed uuid-generator run still required Bearer auth, a quote, and a 900-second lock. The returned UUID was 4cd3c7b6-0495-447a-8efd-9a1374f7599c at $0.00 included. Docs at https://swarme.io/developers still list Search, Describe, Quote, Run. The toast does not skip those steps.
419, 401, and 422 are different stops
| Code | Observed meaning |
|---|---|
| Form toast | Your secure form token expired. Please go back and try again. |
| HTTP 419 | Unauthenticated quote. Your secure request token expired. |
| HTTP 401 | Unauthenticated balance. |
| HTTP 422 | Field rule after a successful quote. |
Observed 422 bodies (Use labeled address lines in key: value form or provide JSON., Enter valid Base64URL input.) are field rules after quote. They are not CSRF. Do not retry them by reloading /en/login.
HTTP 401 on balance means the request had no accepted credential. It does not mean the wallet is empty. A signed-in account can still read $0.00 with billing_mode metered_observe and spend_limit_minor 0. Empty wallet and missing auth are different readings.
First-visit chrome can leave a stale form
On first visit Swarme shows a cookie banner and a language modal. The language list is nine codes: en, ar, es, fr, hi, ha, zh, he, pt. Dismiss those prompts, then reload /en/login so you are not posting a token issued before the modal.
Do not keep clicking submit on a form that has sat idle. The toast already told you to go back. A new GET of /en/login is that fix.
After the form succeeds, use the working developers tab
The URL that serves API keys is https://swarme.io/dashboard?tab=developers. https://swarme.io/dashboard/developers returns 404. A 404 there is not an expired form token. It is the wrong path.
Create a scoped key on that tab. Observed scopes: capabilities:read, capabilities:quote, capabilities:run, uploads:write, artifacts:read, billing:read. The secret is shown once. Prefix sk_sw_QdE8Xfgj.... Do not print a full key. Do not put a key in a URL, a frontend bundle, logs, or a repository.
Send Authorization: Bearer on quote and run. Machine clients should not depend on the login form remaining open. Toast and 419 both mean the request was not accepted as an authenticated client.
What still fails after you are signed in
Signing in does not make 1491 describe_only tools executable. The catalog holds 1940 tools (560 free, 1380 premium; 439 supported, 10 requires_worker). Docs at https://swarme.io/developers state that describe_only blocks quote and run.
MCP does not bypass the form. POST https://swarme.io/mcp initialize (2025-03-26, Swarme Capability MCP Alpha, 2026.07.15-wallet-alpha) listed 22 tools. Those tools still need a Bearer key.
If the next job is a file, processing path still matters. pdf-to-word is client_browser with server_receives_file_bytes false. merge-pdf is async_worker with server_receives_file_bytes true. Review how to choose a secure online file tool before sending bytes. For turning a larger request into a bounded operation after auth is working, see AI tool routing.
A short checklist
- Open https://swarme.io/login. Confirm you are on /en/login.
- If the cookie banner or language modal is up, finish those prompts, then reload the form.
- If you see Your secure form token expired. Please go back and try again., go back and submit once from the new page.
- Do not treat HTTP 419 or HTTP 401 as a 422. 419 is an unauthenticated quote. 401 is an unauthenticated balance.
- Create a key at https://swarme.io/dashboard?tab=developers. Do not use /dashboard/developers.
- Quote and run with Bearer auth. The included UUID path still used a 900-second lock and idempotency_required_for_client true.
Refresh the form token, or stop using the form and send a key.