Troubleshooting
Fix common Cloud Control problems: sign-in and lockout issues, connection health failures, a console that stays empty, and API 401s from tokens or missing sessions.
I can't sign in
- Wrong email or password — the message is identical for both; double-check both. If you forgot your password, use Password reset.
- Locked out (429) — five failures locked the email for 15 minutes. Wait it out, or complete a password reset, which clears the counter.
- Organization suspended (403) — a platform admin has suspended your organization; contact your operator.
- Stuck at the MFA step — your device clock may have drifted; check time sync or use a recovery code. Five wrong codes lock verification for 15 minutes.
A connection won't turn healthy
- Missing permission (409) — the response names the exact missing permission; add it to the IAM role or GCP binding and click Verify again.
- Transient error (503) — a provider hiccup; retry the verification.
- Already connected (409) — this account is connected elsewhere in your org; the error includes the existing connection id.
- Disconnected — re-create the connection rather than verifying a disconnected one.
A section is still empty
The cutover fires only when a connection first reaches healthy. Confirm the connection is healthy on Cloud accounts, then give the first sync a few seconds. The Cost section specifically cuts over only after billing is ingested — trigger POST /api/finops/ingest if needed. Sections without a real engine yet (pipelines, Terraform until you create a workspace, Git until you connect a repo) stay empty by design rather than showing anything fake.
The API returns 401
- No credentials — send a session cookie or an
Authorization: Bearer cc_pat_…header. - Expired or revoked token — expired and revoked tokens return the same
401as unknown ones; create a new token. - Wrong route for Bearer — SSO config, token management, ownership transfer and platform admin are session-only and reject Bearer tokens with
403.
The API returns 404 for an id I know exists
Item routes are org-scoped: an id from another organization returns 404, identical to a non-existent id. Make sure you are operating within the id's own organization. Platform-admin routes also return 404 to non-admins.
A save returns 503 about a keyring
Saving an SSO client secret requires CC_DATA_KEY to be configured. Set it (base64 of 32 random bytes) and redeploy. See Environment variables.