Appwrite Authentication for Logged in / out Users

[Dan425953]

I have the basic sign up form and everything working and tested out the frontend and I see after a successful user sign-up the user is in fact sent to their dashboard correctly and Appwrite is adding the user just fine.

But now I am having difficulty with the Appwrite user authentication. After going through the docs and trying out several different setups I cannot seem to get Appwrite to authenticate and say "Yep, thats a logged in User alright'.

API action that is called 'auth_check' and it is suppoed to confirm that person is logged in and provide back the logged in user details. But I keep getting the same error message from Appwrite: {"message":"User (role: guests) missing scope (account)","code":401,"type":"general_unauthorized_scope","version":"1.5.7"}

But I have full permissions on my one and only secret api key that i have with Appwrite for my specific project, and i checked all the other variables and confirmed them as well.

So i must be missing something in my headers or JSON Body I am assuming to pass onto Appwrite? Can anyone let me know if i am missing something in the Headers / JSON Body? The user can sign-up, and gets added to the Auth section of Appwrite but now authenticating them, and making sure they are a user before allowing them to go to /Dashboard is where I am having trouble.

What am I missing?

[wellkilo]

User (role: guests) missing scope (account) means the request reached Appwrite without a valid user session. An API key is not a replacement for the Account API's current-user session; API keys are for Server SDK/admin operations, while account.get() resolves the user represented by the browser/client session.

For a browser application:

const client = new Client()
  .setEndpoint('https://cloud.appwrite.io/v1')
  .setProject(PROJECT_ID)

const account = new Account(client)

await account.createEmailPasswordSession(email, password)
const user = await account.get()

Use the same Appwrite endpoint/project for both calls and let the SDK/browser carry the session cookie. Do not put a project API key in frontend code.

If account.get() runs in your own backend/server action, the browser's Appwrite cookie is not automatically forwarded to that separate server process. Use an SSR session flow and initialize the server SDK with the user's session secret, or create a short-lived JWT from an authenticated client and send that to your backend. A client-side session created only in the browser does not magically authenticate an unrelated backend request.

Useful checks:

1. In browser devtools, confirm the session-creation response succeeds and an Appwrite session cookie is stored/sent.
2. Verify the configured Web platform hostname matches the site origin.
3. Ensure the endpoint is consistent (cloud.appwrite.io versus a custom/self-hosted domain); cross-origin cookie rules matter.
4. Remove any frontend setKey(...); it is both unsafe and the wrong identity for Account.

Appwrite's own service docs distinguish these scopes: the Account API operates as the current logged-in user, while the Users API is server-side/admin-scoped. If this resolves the guest-scope error, please mark the reply as accepted.