The toast on Swarme's login Fom is a CSRF failure, not a catalog outage. The exact copy is Your secure Fom token expired. Please go back and try again. That sentence is the product's instruction. Follow it. Do not treat it as a 422 Filin rule, a describe_only block, or a missing kayan aiki.
A parallel failure exists on the machine path. An unauthenticated quote returns HTTP 419 and the message Your secure request token expired. An unauthenticated GET /api/account/balance returns HTTP 401. Keep those three outcomes separate in logs: the Fom toast, 419, and 401.
What the toast is, and what it is not
The login Fom uses a secure Fom token. When that token expires, the toast appears. Reload the Shafi and submit once from the fresh Fom. The login entry point is https://swarme.io/login, which resolves zuwa /en/login. The Fom offers Google at /auth/google and email/password. This walkthrough does not claim a completed Google callback. It records the toast on the Fom that was actually submitted.
This toast is not a UUID defect, a 422 Filin rule, the 404 on /dashboard/developers, SSL EOF during a crawl, or proof that 1491 describe_only tools cannot be described.
A completed uuid-generator run still required Bearer auth, a quote, and a 900-second lock. The returned UUID was 4cd3c7b6-0495-447a-8efd-9a1374f7599c at $0.00 included. Docs at https://swarme.io/developers still list Bincike, Describe, Quote, Run. The toast does not skip those steps.
419, 401, and 422 are different stops
Observed 422 bodies (Use labeled address lines in key: value Fom or provide JSON., Enter valid Base64URL input.) are Filin rules after quote. They are not CSRF. Do not retry them by reloading /en/login.
HTTP 401 on balance means the request had no accepted credential. It does not mean the wallet is empty. A signed-in account can still read $0.00 with billing_mode metered_observe and spend_limit_minor 0. Empty wallet and missing auth are different readings.
First-visit chrome can leave a stale Fom
On first visit Swarme shows a cookie banner and a language modal. The language list is nine codes: en, ar, es, fr, hi, ha, zh, he, pt. Dismiss those prompts, then reload /en/login so you are not posting a token issued before the modal.
Do not keep clicking submit on a Fom that has sat idle. The toast already told you zuwa go back. A new GET of /en/login is that fix.
After the Fom succeeds, use the working developers tab
The URL that serves API keys is https://swarme.io/dashboard?tab=developers. https://swarme.io/dashboard/developers returns 404. A 404 there is not an expired Fom token. It is the wrong path.
Ƙirƙira a scoped key on that tab. Observed scopes: capabilities:read, capabilities:quote, capabilities:run, uploads:write, artifacts:read, billing:read. The secret is shown once. Prefix sk_sw_QdE8Xfgj.... Do not print a full key. Do not put a key in a URL, a frontend bundle, logs, or a repository.
Send Authorization: Bearer on quote and run. Machine clients should not depend on the login Fom remaining open. Toast and 419 both mean the request was not accepted as an authenticated client.
What still fails after you are signed in
Signing in does not make 1491 describe_only tools executable. The catalog holds 1940 tools (560 Kyauta, 1380 Premium; 439 supported, 10 requires_worker). Docs at https://swarme.io/developers state that describe_only blocks quote and run.
MCP does not bypass the Fom. POST https://swarme.io/mcp initialize (2025-03-26, Swarme Capability MCP Alpha, 2026.07.15-wallet-alpha) listed 22 tools. Those tools still need a Bearer key.
If the next job is a Fayil, processing path still matters. pdf-zuwa-word is client_browser with server_receives_Fayil_bytes false. merge-pdf is async_worker with server_receives_Fayil_bytes true. Review how zuwa choose a secure kan layi Fayil kayan aiki before sending bytes. For turning a larger request into a bounded operation after auth is working, see AI kayan aiki routing.
A short checklist
- Open https://swarme.io/login. Confirm you are on /en/login.
- If the cookie banner or language modal is up, finish those prompts, then reload the Fom.
- If you see Your secure Fom token expired. Please go back and try again., go back and submit once from the new Shafi.
- Do not treat HTTP 419 or HTTP 401 as a 422. 419 is an unauthenticated quote. 401 is an unauthenticated balance.
- Ƙirƙira a key at https://swarme.io/dashboard?tab=developers. Do not use /dashboard/developers.
- Quote and run with Bearer auth. The included UUID path still used a 900-second lock and idempotency_required_for_client true.
Refresh the Fom token, or stop using the Fom and send a key.