diff --git a/dozer-cli/src/errors.rs b/dozer-cli/src/errors.rs
index cb5ff4d37d..3e0bfbee46 100644
--- a/dozer-cli/src/errors.rs
+++ b/dozer-cli/src/errors.rs
@@ -4,6 +4,7 @@ use glob::{GlobError, PatternError};
 use std::io;
 use std::path::PathBuf;
 use std::string::FromUtf8Error;
+use tonic::Code;
 use tonic::Code::NotFound;
 
 use crate::{
@@ -142,7 +143,7 @@ pub enum CloudError {
     #[error("Connection failed. Error: {0:?}")]
     ConnectionToCloudServiceError(#[from] tonic::transport::Error),
 
-    #[error("Cloud service returned error: {}", .0.message())]
+    #[error("Cloud service returned error: {}", map_status_error_message(.0.clone()))]
     CloudServiceError(#[from] tonic::Status),
 
     #[error("GRPC request failed, error: {} (GRPC status {})", .0.message(), .0.code())]
@@ -290,3 +291,12 @@ pub enum CloudContextError {
     #[error("App id already exists. If you want to create a new app, please remove your cloud configuration")]
     AppIdAlreadyExists(String),
 }
+
+fn map_status_error_message(status: tonic::Status) -> String {
+    match status.code() {
+        Code::PermissionDenied => {
+            "Permission denied. Please check your credentials and try again.".to_string()
+        }
+        _ => status.message().to_string(),
+    }
+}