Since krz/gitbay 89dd0a3 an expiring credential cannot run credential-minting commands (keys add, email add, email verify). The sign-in hint mints a 90-day token, so those actions are always refused in the app. GitbayError.userFacingMessage now maps that denial to: "This needs a token without an expiry. Add it on the web under Settings, or over SSH." Other denials pass through unchanged. 2 unit tests (579 pass), Release build. testAccountFlows' assertion follows the new text; not re-run live (token revoked).