da_preview_content returns 401 [admin] not authenticated — DA token reused against admin.hlx.page auth domain

[a-tondo]

Summary

da_preview_content returns 401 Unauthorized / [admin] not authenticated — hard failure, the page is never previewed. Reads (da_get_source), copies (da_copy_content), and source writes (da_update_source) against the same org/repo authenticate normally; only the preview/live family fails.

Observed against adobecom / da-dc-sandbox, path acrobat/online/sign-contract, on 2026-09-09.

da_preview_content(org="adobecom", repo="da-dc-sandbox", path="acrobat/online/sign-contract")

Admin API Error (401): Unauthorized
{
  "xError": "[admin] not authenticated"
}

Root cause — auth-domain mismatch

A single bearer token is extracted in src/index.ts and forwarded verbatim to two different auth domains:

• admin.da.live (via the daadmin service binding) for source read/create/update/copy — src/da-admin/client.ts request(). The DA token is valid here, so reads/copies/writes authenticate.
• admin.hlx.page (the Helix admin API, via plain fetch() in requestHlx()) for preview/live — src/da-admin/client.ts previewContent() / requestHlx().

Legacy DA preview/live reuse the same DA token against admin.hlx.page, which authenticates against its own identity / access-control system (Helix admin site config / org profile). When that token is not authorized on admin.hlx.page for the org/repo, Helix returns 401 with x-error: [admin] not authenticated — exactly the string observed.

The x-content-source-authorization header sent alongside only covers the content-source fetch; the primary Authorization header identifying the caller to admin.hlx.page is what is rejected.

This is deterministic, not a session/token expiry — it fails on every attempt for any org/repo where the DA token is not also a valid admin.hlx.page credential (matches the "401 every attempt" observation). The same requestHlx() path backs da_unpreview_content, da_publish_content, and da_unpublish_content, so all four are affected.

Relevant code:

• Token pass-through: src/index.ts (apiToken: token)
• Two auth targets: src/da-admin/client.ts request() (admin.da.live) vs requestHlx() (admin.hlx.page)
• Preview call: src/da-admin/client.ts previewContent()

Suggested direction (for discussion — not implemented)

• Document/validate the credential requirement for admin.hlx.page, and surface an actionable error (e.g. "not authorized for preview on this org/repo — the DA token is not a valid Helix admin credential") instead of a raw 401.
• Determine whether a separate content-source/admin credential must be threaded through for the preview/live family, or whether preview/live should be gated/skipped when the token lacks Helix admin authorization.

Workaround in place

• Trigger Preview manually from the DA editor instead of da_preview_content.

Expected behavior

da_preview_content authenticates and previews the page, or returns an actionable auth error the caller can act on (e.g. "reconnect DA MCP" / "token not authorized for preview").