Docs
Open the console →
Help

Troubleshooting

Fix common Cloud Control problems: sign-in and lockout issues, connection health failures, a console that stays empty, and API 401s from tokens or missing sessions.

I can't sign in

  • Wrong email or password — the message is identical for both; double-check both. If you forgot your password, use Password reset.
  • Locked out (429) — five failures locked the email for 15 minutes. Wait it out, or complete a password reset, which clears the counter.
  • Organization suspended (403) — a platform admin has suspended your organization; contact your operator.
  • Stuck at the MFA step — your device clock may have drifted; check time sync or use a recovery code. Five wrong codes lock verification for 15 minutes.

A connection won't turn healthy

  • Missing permission (409) — the response names the exact missing permission; add it to the IAM role or GCP binding and click Verify again.
  • Transient error (503) — a provider hiccup; retry the verification.
  • Already connected (409) — this account is connected elsewhere in your org; the error includes the existing connection id.
  • Disconnected — re-create the connection rather than verifying a disconnected one.

A section is still empty

The cutover fires only when a connection first reaches healthy. Confirm the connection is healthy on Cloud accounts, then give the first sync a few seconds. The Cost section specifically cuts over only after billing is ingested — trigger POST /api/finops/ingest if needed. Sections without a real engine yet (pipelines, Terraform until you create a workspace, Git until you connect a repo) stay empty by design rather than showing anything fake.

The API returns 401

  • No credentials — send a session cookie or an Authorization: Bearer cc_pat_… header.
  • Expired or revoked token — expired and revoked tokens return the same 401 as unknown ones; create a new token.
  • Wrong route for Bearer — SSO config, token management, ownership transfer and platform admin are session-only and reject Bearer tokens with 403.

The API returns 404 for an id I know exists

Item routes are org-scoped: an id from another organization returns 404, identical to a non-existent id. Make sure you are operating within the id's own organization. Platform-admin routes also return 404 to non-admins.

A save returns 503 about a keyring

Saving an SSO client secret requires CC_DATA_KEY to be configured. Set it (base64 of 32 random bytes) and redeploy. See Environment variables.