Token too short. In production the server logs a startup warning when the admin token is shorter than 16 characters. There is no hard rejection, but a short token is brute-forceable — use at least 32 bytes of entropy. Rotate via Settings → Rotate token if you need to replace a weak token.
/_admin/* returns 404. The admin is not active. Confirm the binary was built with the admin feature (the Standard and Pro binaries include it), that a Core+, Standard, or Pro license is loaded (via ACCENTCMS_LICENSE or license.key), and that admin.enabled: true is set in config.yaml. The runtime middleware returns 404 whenever any of these is missing.
Login fails with “Token does not match.” The submitted token does not match the configured value. Remember the ACCENT_ADMIN_TOKEN environment variable overrides admin.token whenever it holds a value; an empty or whitespace-only variable is ignored. Repeated failures are rate-limited to 10 per minute (429 once exhausted), and the correct token is still accepted while they are.
Admin shell not mounted / Core+ upsell at startup. The admin UI is a licensed feature in dev and production. Without a Core+, Standard, or Pro key the server prints a Core+ upsell and leaves /_admin/* unmounted. Add a key via ACCENTCMS_LICENSE or license.key to evaluate or run the admin – a Core+ key is the cheapest tier that unlocks it. Note that Core+ does not unlock accent serve --production, which still requires Standard or Pro.