> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Find the fix for the most common CloudThinker problems, from sign-in and connections to approvals, products, Workers and the CLI.

Find your symptom, try the quick check, and open the full fix if that doesn't solve it.

## Getting started

| Symptom | Quick check | Full fix |
| - | - | - |
| You want to try CloudThinker before connecting production | Connect a staging or sandbox account with a read-only role first. | [Quickstart](https://docs.cloudthinker.io/quickstart.md) |
| You can't find where to add a connection | In the sidebar, click **More → Workspace settings → Connections**. | [Add a connection](https://docs.cloudthinker.io/guide/connections/overview.md#add-a-connection) |
| An agent can't find a connection you added | Connections belong to one workspace. Check the workspace name in the sidebar. | [Workspaces](https://docs.cloudthinker.io/guide/workspaces.md#troubleshooting) |
| A new connection's Discovery section is still empty | Discovery runs once per connection, for up to 30 minutes. It pauses if the credit balance is too low. | [After you connect](https://docs.cloudthinker.io/guide/connections/overview.md#what-happens-after-you-connect) |
| Optimize shows no cost data after a scan | On a new AWS account, Cost Explorer can take up to 24 hours to start, and it lags usage by 24 to 48 hours. | [Optimize quickstart](https://docs.cloudthinker.io/guide/cost-optimization/quickstart.md#troubleshooting) |

## Sign-in, SSO and members

| Symptom | Quick check | Full fix |
| - | - | - |
| A user can't sign in after you required SSO | Is the user assigned to the CloudThinker app in your IdP? | [SSO](https://docs.cloudthinker.io/guide/security/sso.md#troubleshooting) |
| Your IdP reports an invalid ACS or reply URL, or an audience mismatch | The values must match exactly: `https://`, no trailing slash, case-sensitive. | [SAML SSO](https://docs.cloudthinker.io/guide/security/sso-saml.md#troubleshooting) |
| "Redirect URI mismatch", Issuer Match or Discovery Reachable fails | Copy `issuer` straight from the discovery document. The issuer must be reachable from the public internet. | [OIDC SSO](https://docs.cloudthinker.io/guide/security/sso-oidc.md#troubleshooting) |
| A user wasn't provisioned, or someone who left can still sign in | Look for a `FAILED` entry in **View sync logs**. Unassign leavers on the app itself, not only the group. | [SCIM](https://docs.cloudthinker.io/guide/security/scim.md#troubleshooting) |
| The invite button says Seats full, or you can't remove a member | Pending invitations use seats too. Admins can't remove other Admins or the Owner. | [Organization](https://docs.cloudthinker.io/guide/organization.md#troubleshooting) |
| A teammate can't see a workspace | Developers and Viewers only see workspaces they were added to. | [Workspaces](https://docs.cloudthinker.io/guide/workspaces.md#troubleshooting) |
| The person isn't in the Add Member list | They may not be in the organization yet, or they're an organization Owner or Admin who already has access. | [Workspace members](https://docs.cloudthinker.io/guide/workspace-users.md#troubleshooting) |
| A Viewer can't type in the chat | Viewers are read-only. Change their **Workspace Role** to **Developer**. | [Workspace members](https://docs.cloudthinker.io/guide/workspace-users.md#troubleshooting) |

## Connections, chat and commands

| Symptom | Quick check | Full fix |
| - | - | - |
| A connection won't verify, or shows **Error** | Open the connection: the detail panel shows the error. Fix the cause at the provider, then click **Retry** or **Replace credentials**. | [When a connection breaks](https://docs.cloudthinker.io/guide/connections/overview.md#when-a-connection-breaks), then your provider: [AWS](https://docs.cloudthinker.io/guide/connections/aws.md#troubleshooting), [Azure](https://docs.cloudthinker.io/guide/connections/azure.md#troubleshooting), [GCP](https://docs.cloudthinker.io/guide/connections/gcp.md#troubleshooting), [Kubernetes](https://docs.cloudthinker.io/guide/connections/kubernetes.md#troubleshooting), [GitHub](https://docs.cloudthinker.io/guide/connections/github.md#troubleshooting) |
| A command doesn't expand, or the `/` menu shows Nothing matches | A skill with the same name wins the slug. Check the slug's spelling on **More → Workspace settings → Commands**. | [Commands](https://docs.cloudthinker.io/guide/commands.md#troubleshooting) |
| A credential name is rejected, or you can't see the `$` picker | Keys take uppercase letters, digits and underscores only. The `$` picker needs the workspace Admin role. | [Credentials](https://docs.cloudthinker.io/guide/credentials.md#troubleshooting) |
| The Slack bot doesn't reply, or answers with the wrong account | Is the bot in the channel (`/invite @CloudThinker`), and did you mention it in a new message? | [Slack](https://docs.cloudthinker.io/guide/slack-integration.md#troubleshooting) |
| The Teams bot doesn't reply, or a team isn't linked to a workspace | Your Teams admin settings may block custom apps. | [Microsoft Teams](https://docs.cloudthinker.io/guide/teams-integration.md#troubleshooting) |

## Approvals and automations

| Symptom | Quick check | Full fix |
| - | - | - |
| A write still asks you even though a Rule allows it | The run uses **Manual**, which asks before every write. | [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md#troubleshooting) |
| You don't see the Approve button | Viewers can't approve, and a Rule may send the ask to a group you aren't in. The card names who can. | [Approvers](https://docs.cloudthinker.io/guide/approvals/approvers.md#troubleshooting) |
| An automation refused a write instead of asking | Automations default to **Auto · Rules + AI · Refuse**. Pick an **Ask me** choice, which works today. An Allow Rule for that write helps only once [Rule enforcement](https://docs.cloudthinker.io/guide/approvals/rules.md#troubleshooting) is on for your workspace. | [Approval mode FAQ](https://docs.cloudthinker.io/guide/approvals/approval-mode.md#faq) |
| A run sits on Required Approval, or an automation turned itself off | Open the run's conversation from **Runs**. Ten failed runs in a row turn an automation off. | [Autonomous operations](https://docs.cloudthinker.io/guide/automation/autonomous-agents.md#troubleshooting) |
| The run succeeded but nothing posted in Slack | Read the run's conversation first. Then check Slack is on for **Agent alerts** in **Notifications**. | [Automation quickstart](https://docs.cloudthinker.io/guide/automation/quickstart.md#troubleshooting) |

## Products

**Resolve** handles production incidents. Its intake layer, [Pulse](https://docs.cloudthinker.io/guide/pulse/overview.md), takes alerts from your tools and groups them into clusters. **Review** reviews pull requests. **Optimize** covers cloud cost. **Cyber** tests your applications for security flaws. **Memory** is what CloudThinker remembers about your workspace between chats.

| Symptom | Quick check | Full fix |
| - | - | - |
| Resolve: Pulse shows No signals yet | Check your monitoring tool's delivery log, then paste the webhook URL again and fire a test alert. | [Alerts not arriving](https://docs.cloudthinker.io/guide/incident/troubleshooting.md#alerts-not-arriving) |
| Resolve: every alert opens its own cluster | A repeat joins the open cluster only when source, alert type and resource ID all match. | [Clusters not forming](https://docs.cloudthinker.io/guide/incident/troubleshooting.md#clusters-not-forming) |
| Resolve: incidents wait in Not started | **On duty** is paused. Check the header of **Resolve → Investigation**. | [Investigation not starting](https://docs.cloudthinker.io/guide/incident/troubleshooting.md#investigation-not-starting) |
| Resolve: analysis failed, or an investigation looks stuck | Click **Watch live** on the incident. If the timeline is moving, it isn't stuck. | [Investigation stuck](https://docs.cloudthinker.io/guide/incident/troubleshooting.md#investigation-stuck) |
| Resolve: a runbook command waits for approval or was blocked | Commands from Confluence, GitHub and GitLab always require approval. | [Runbook not running](https://docs.cloudthinker.io/guide/incident/troubleshooting.md#runbook-not-running) |
| Review didn't post on a pull request | Draft PRs aren't reviewed. Check the repository's **Review** switch in **Review → Settings → Repositories**. | [No comment on a new PR](https://docs.cloudthinker.io/guide/code-review/troubleshooting.md#no-comment-on-a-new-pr) |
| Review shows **Reconnect your Git provider** | Click the alert's button and reconnect, or paste a new token with the same scopes. | [Provider auth errors](https://docs.cloudthinker.io/guide/code-review/troubleshooting.md#provider-auth-errors) |
| Optimize: a spike you can see in your cloud console isn't listed | Compare the date with **Billing data through**. New accounts need 14 finalized days first. | [Anomalies](https://docs.cloudthinker.io/guide/cost-optimization/anomalies.md#troubleshooting) |
| Optimize: the findings total is \$0 or doesn't match Overview | A **Service** filter on **Findings** changes the total. Clear it. | [Savings](https://docs.cloudthinker.io/guide/cost-optimization/savings.md#troubleshooting) |
| Cyber: target ownership stays at Needs proof, or protected pages aren't tested | Some DNS providers append the zone name, so the domain appears twice in the TXT record name. | [Cyber quickstart](https://docs.cloudthinker.io/guide/security/cyber-quickstart.md#troubleshooting) |
| Cyber: a fixed finding came back, or Awaiting retest never clears | A later scan proved the problem again. Open the app's **Runs** link to see which run. | [Cyber findings](https://docs.cloudthinker.io/guide/security/cyber-findings.md#troubleshooting) |
| Memory shows Not ready yet, or an edit says the item changed | Click **Retry** after a few seconds, or **Reload** and make the edit again. | [Memory](https://docs.cloudthinker.io/guide/memory.md#troubleshooting) |

## Workers and the CLI

| Symptom | Quick check | Full fix |
| - | - | - |
| The Worker shows Offline, or verification failed | Run `cloudthinker worker status --outpost <name>`, or `cloudthinker worker doctor` in the folder. | [Workers](https://docs.cloudthinker.io/guide/workers.md#troubleshooting) |
| A teammate gets `EXECUTOR_TARGET_PRIVATE` | They tried to use your personal Worker. Create a shared Worker instead. | [Workers](https://docs.cloudthinker.io/guide/workers.md#troubleshooting) |
| `cloudthinker: command not found` | The shell started before `~/.local/bin` was added to `PATH`. Open a new shell. | [CLI overview](https://docs.cloudthinker.io/guide/cli/overview.md#troubleshooting) |
| A command says you are not logged in (exit code 3) | The credential is missing or expired. Run `cloudthinker login`, then `cloudthinker whoami`. | [CLI authentication](https://docs.cloudthinker.io/guide/cli/authentication.md#troubleshooting) |
| A headless run exits with code 5 | The run paused for an approval. Open its `web_url` and decide. | [Headless chat](https://docs.cloudthinker.io/guide/cli/headless-chat.md#troubleshooting) |
| A headless prompt is rejected as too long | The prompt plus piped input is over 50,000 characters. | [Headless chat](https://docs.cloudthinker.io/guide/cli/headless-chat.md#troubleshooting) |

Every CLI exit code (0 to 5, and 130) and what to do about it is in [Exit codes](https://docs.cloudthinker.io/guide/cli/headless-chat.md#exit-codes).

## Admin and billing

| Symptom | Quick check | Full fix |
| - | - | - |
| You don't see Audit Logs, or the export has fewer rows than expected | Audit Logs needs the organization Admin role. Events older than 90 days are deleted. | [Audit logs](https://docs.cloudthinker.io/guide/security/audit-logs.md#troubleshooting) |
| A guardrail pattern won't save, or Guardrails isn't in Admin Settings | The error names the check that failed. Saving needs the workspace Admin role, and **Admin Settings** is in the menu only for organization Owners and Admins. A workspace Admin who is neither opens **Guardrails** from a direct link. | [Custom guardrails](https://docs.cloudthinker.io/guide/security/custom-guardrails.md#troubleshooting) |
| You can't change the workspace BYOK setting | You aren't a workspace Admin, or the Owner requires the organization key everywhere. The page says which. | [BYOK](https://docs.cloudthinker.io/guide/byok.md#troubleshooting) |
| A workspace kept spending past its credit limit | That's expected on **Notify only**, which never blocks. Switch the workspace to **Throttle** to stop paid spend at the limit. | [How enforcement works](https://docs.cloudthinker.io/guide/billing/credit-limits.md#how-enforcement-works) |
| A workspace stopped running agents but chat still works | It's on **Throttle** and hit its limit, so only free daily credits are left. | [Credit limits](https://docs.cloudthinker.io/guide/billing/credit-limits.md#troubleshooting) |

## Collect diagnostics

Check these before you ask for help. They often show the cause on their own.

* **Automation run:** open it from **Runs** and read its conversation for the error.
* **Incident:** click **Watch live** to see each check as it runs.
* **Connection:** open it. The detail panel shows the last error.
* **Who changed what:** **Admin Settings → Audit Logs** (organization Admin role, Scale plan or higher).
* **CLI:** `cloudthinker whoami` and `cloudthinker auth status` show who you're logged in as and your saved workspaces. For a headless run, `cloudthinker chat status <run_id>` shows its state.
* **Worker:** `cloudthinker worker doctor` in the Worker's folder prints what failed and how to fix it.

## Still stuck?

Ask in the [CloudThinker Discord](https://discord.com/invite/sRBWRWtaNR) or [contact us](https://cloudthinker.io/contact). Include:

* Your workspace name
* What you expected, and what happened instead
* What you clicked, or the command you ran
* The exact error text, and the run ID if there is one
* When it happened, with your time zone

## Related

> **[Glossary](https://docs.cloudthinker.io/guide/glossary.md)**
>
> Look up any CloudThinker term.

> **[FAQ](https://docs.cloudthinker.io/learn/faq.md)**
>
> Answers to common questions about plans, data and access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.