Thanks so much for the detailed report — this was super helpful, and you nailed it: these were two real, distinct bugs on the platform side (not anything wrong with your app), which is exactly why local dev never reproduced them.
We’ve shipped fixes for both error cases:
1. Sampling token missing
The Anna App iframe invoke path wasn’t minting a sampling token the way the chat-agent path did. It now mints tokens on both paths, so authorized sampling calls go through consistently.
2. invalid sampling token: Signature has expired
Sampling tokens were issued once per invoke with a short lifetime, so long-running or multi-call invokes could outlive the token. We added end-to-end token renewal — the host now proactively refreshes before expiry and retries seamlessly, so your retries won’t keep hitting an already-expired token.
Give it a spin
The easiest way to validate in a dev environment is the LLM demo plus a push:
If you still see -32001 after this
At that point it’s almost certainly an authorization step rather than the token mechanism itself. Two quick things to check:
Your executa’s manifest declares host_capabilities: ["llm.sample"] and the capability has propagated (a re-publish / rediscover refreshes it).
Sampling is enabled for your executa via the per-user grant (the Permissions toggle) — this is a separate consent from the app-level grants.
Give it a try and let us know how it goes — happy to dig in further if anything still feels off. Thanks again for helping make Anna better!