When I click the Deploy button in DEMS Config Details, I get "Admin service returned an error." TCS backend logs show a 401 Unauthorized. How do I...

This is an authentication error between the TCS backend and the Admin service. The TCS logs will show: POST /v1/admin/tcs/config/write failed with status 401: {"error":"Unauthorized"}. Verify that the following environment variables are correctly set in your TCS deployment: TAZAMA_AUTH_URL (e.g., http://tazama-core-auth:3020/v1/auth), TAZAMA_AUTH_ADMIN_USERNAME, TAZAMA_AUTH_ADMIN_PASSWORD, AUTH_PUBLIC_KEY_PATH (pointing to your public key PEM file), and ADMIN_SERVICE_URL. For ADMIN_SERVICE_URL, the port depends on the network path: the admin-service listens on 3100 inside its container, so use the container hostname with port 3100 (e.g., http://admin-service:3100) when TCS shares the Docker network with the core stack; when TCS reaches the admin-service across hosts, use the host-published port instead (ADMIN_PORT, 5100 by default in tazama-stack), e.g., http://:5100. Mixing the two (a container hostname with port 5100, or a host address with port 3100) is a common cause of connection failures. This issue was reported for self-hosted deployments in July 2026 and was under active investigation. Update (July 2026): There is no dedicated "deploy" button in the standard config flow - the correct process is to create a config in the editor scope, approve it in the approver scope, and then activate it (also from the approver scope), which makes it available on DEMS. If you are seeing this error, first confirm which user scope/role you are logged in with when performing the action. The team asked for a dedicated beta-testing discussion thread with step-by-step repro instructions (including user scope per step) to continue diagnosing this issue. Post in #get-help or #tazama-public-beta for the latest resolution status. Source: #tazama-public-beta, July 2026.