Token too short. In production the server logs a startup warning when the admin token is shorter than 16 characters. There is no hard rejection, but a short token is brute-forceable — use at least 32 bytes of entropy. Rotate via Settings → Rotate token if you need to replace a weak token.
/_admin/* returns 404. The admin is not active. Confirm the binary was built with the admin feature (Standard or Pro edition; Core has no admin code) and that admin.enabled: true is set in config.yaml. The runtime middleware returns 404 whenever admin.enabled is false.
Login fails with “Token does not match.” The submitted token does not match the configured value. Remember the ACCENT_ADMIN_TOKEN environment variable overrides admin.token; if both are set, the env var wins. Repeated failures are rate-limited to 10 per minute (429 once exhausted).
License required in production.accent serve --production requires a Standard or Pro license, and the admin ships in those editions only. Dev-mode accent serve runs all features without a license, so you can evaluate the admin before purchasing.