Entire `website` command surface returns "Session expired" while all other authenticated commands work

[middlecoast]

CLI: higgsfield v1.1.23, macOS. Freshly authenticated via auth login (plus plan).

Working: account status, workspace list (workspace c2a97241-f09c-4a0a-9c98-7e282996fddc selected). The auth session is valid.

Failing: every higgsfield website * command returns Error: Session expired immediately, including website categories, which is not site-specific. --json does not surface the underlying HTTP status, so we cannot tell a 401 from a 403 or 5xx client-side.

Corroborating: the MCP server at mcp.higgsfield.ai dropped its entire website toolset (deploy_website, list_websites, website_status, website_repo_access, etc.) mid-session on 2026-08-23. In a fresh session on 2026-08-24 the server's instructions state "Website Builder apps, games, and websites are temporarily unavailable." Meanwhile the marketing page at https://higgsfield.ai/skills/website is still live and advertising the feature.

Notes: OAuth login grants email profile offline_access user:org:read only, nothing website-scoped. Our deployed site (id 6e0bf54b-5208-4ed6-8003-3896574b7886) continues to serve fine; only management/deploy is blocked.

Questions:

1. Is the website API surface temporarily disabled platform-side? If so, is there an ETA?
2. If it is an entitlement/scope issue instead, what is missing from a plus-plan account?
3. Feature request: surface the raw HTTP status/error body under --json so this class of failure is diagnosable client-side.

[ronjrcamacho]

Same here, on a different account and workspace — and I was able to get the underlying
HTTP status you couldn't see from the CLI.

The gateway is not rejecting our token. It authenticates us fine, then fails on its own
internal call to the apps-marketplace service.

Same endpoint, three auth states:

valid token    -> 401 {"detail":"apps-marketplace /list failed (HTTP 401): {\"detail\":\"Invalid x-api-key\"}"}
no token       -> 401 {"detail":"Invalid or expired token"}
garbage token  -> 401 {"detail":"Invalid or expired token"}

A bad token dies at the gateway with Invalid or expired token. A valid token gets past
the gateway and dies one hop later on Invalid x-api-key — a server-side key between
fnf-api-gw and apps-marketplace. Nothing a user can configure.

Confirming it's specific to the websites surface, on the same token in the same session:

GET /fnf/developer/v2alpha/account/workspaces  -> 200
GET /fnf/developer/v1alpha/websites            -> 401 (above)
GET /fnf/developer/v1alpha/website-categories  -> 401 (above)

generate, soul-id, voices, upload, model and preset all respond normally.
There's no alternate route either — v2alpha/websites, v1/websites and v1alpha/apps
all 404. CLI is 1.1.23, the current npm latest.

So to your question 2: it isn't an entitlement or scope issue. The OAuth scope
(email profile offline_access user:org:read) is exactly what the CLI requests — it's in
the binary — and it's sufficient for every other endpoint.

Strongly seconding your question 3. Surfacing the raw upstream status under --json would
have saved both of us the detour: "Session expired. Run: higgsfield auth login" sends
people to re-authenticate repeatedly for a fault that has nothing to do with their session.
Re-logging in does not help and cannot help. Worth fixing the message even after the
service is back.