OAuth errors
Each section below is one error a person or your app can hit while signing in or adding an app. It says what the message means, who fixes it, and gives the page where it gets fixed. The server links straight to the section that matches the error.
Connected before, then cut off? See Handling revoked access.
This app isn't set up for your company
What it means. The sign-in page shows:
This app isn't set up for your company. If it's your company's app, your admin can add it.
The same message appears when the app belongs to another company and when the
app does not exist. That is on purpose: the message never reveals whether another
company has an app with this client_id.
Who fixes it. Your company's admin, by adding the app.
Where. Add your app. Developers: see Add your app.
Registering: this app isn't set up for your company
What it means. POST /api/v1/oauth/register answered 400
invalid_redirect_uri with the same message as above. The callback URL has not
been added by any company.
Who fixes it. A company admin adds the app and its callback URL first. Tools that register themselves, such as AI assistants, are covered in AI assistants and tools that register themselves.
Where. Add your app.
You don't have access to this app yet
What it means. The sign-in page shows:
You don't have access to this app yet. Your company's admin needs to allow it for you.
The app is set up for your company, but your role is not on its list of who can use it. New apps start with account owners only.
Who fixes it. You press Request access, and an admin allows it. Or an admin changes who can use the app.
Where. OAuth apps. See Let your staff use an app.
Your request is waiting for an admin
What it means. The sign-in page shows:
Your request was sent. You'll be able to sign in once an admin allows it.
You already asked for access and nobody has answered yet. There is no button, because there is nothing more for you to do.
Who fixes it. An admin answers the request with Allow or Dismiss.
Where. OAuth apps.
This callback URL isn't one of the app's URLs
What it means. The redirect_uri your app sent is not one of the callback
URLs saved on the app. The message reads:
This callback URL isn't one of this app's URLs. This app has: …
followed by the URLs that are saved. The match is exact and on the full URL, so a
trailing slash, a different path or http instead of https is a different URL.
Case in the scheme and host is ignored, and so is a default :443.
Who fixes it. Either your app sends one of the saved URLs, or an admin adds the one it sends.
Where. OAuth apps. To add a URL, open Add your app.
Callback URLs must use https
What it means. The callback URL does not start with https://. Internet hosts
need https, so http://app.example.com/callback is refused.
Loopback is the one exception, and only for tools that register themselves, such
as AI assistants: their http://localhost and http://127.0.0.1 callbacks work.
Your company's own apps do not get that exception.
Who fixes it. Whoever enters the URL: change it to https://.
Where. OAuth apps.
This callback URL can't be saved
What it means. Add app refused the URL. The message says which rule it broke:
| Case | Message |
|---|---|
| Not a full URL | This isn't a full URL. Enter it exactly as your app sends it, starting with https://. |
No https | Callback URLs must start with https://. |
| An IP address | Use your app's domain name, not an IP address. |
| A wildcard | Wildcards aren't allowed. Add each callback URL in full. |
A # fragment | A callback URL can't contain a # fragment. |
localhost | localhost callbacks can't be used with your company's apps. Use an https:// URL on your app's domain. |
| A desktop-app scheme | Desktop-app callbacks can't be used with your company's apps. Use an https:// URL on your app's domain. |
Your company's apps take https callbacks on a real domain, and nothing else.
For local development, serve your callback over https on a domain you control.
Who fixes it. Whoever enters the URL.
Where. Add your app.
You can't manage apps
What it means. The message reads:
You don't have permission to manage your company's apps. Your admin can give your role Manage OAuth apps.
Adding, editing and removing apps needs the Manage OAuth apps permission on your role. Account owners always have it.
Who fixes it. An account owner turns on Manage OAuth apps for your role.
Where. Roles.
The app needs a name
What it means. Add app refused the name:
- "Give the app a name."
- "App names can be at most 100 characters."
Who fixes it. Whoever adds the app: enter a name of 1 to 100 characters.
Where. Add your app.
The app needs callback URLs
What it means. An app has between 1 and 10 callback URLs:
- "Add at least one callback URL."
- "An app can have at most 10 callback URLs."
Who fixes it. Whoever adds or edits the app.
Where. Add your app.
One of the chosen roles doesn't exist
What it means. The message reads:
One of the chosen roles doesn't exist on your account.
A role was deleted after the form opened, or the request named a role that is not on your account.
Who fixes it. Whoever edits the app: reload the page and choose the roles again.
Where. OAuth apps.
This connection doesn't exist
What it means. The message reads:
This connection doesn't exist or was already removed.
Someone already disconnected it, or it never existed.
Who fixes it. Nobody. Reload the list.
Where. OAuth apps.
You already have access
What it means. The message reads:
You already have access to this app.
Your role is already allowed, so there is nothing to request.
Who fixes it. Nobody. Sign in again.
Where. Start the sign-in from your app again.
We couldn't check your access right now
What it means. A 503 with the message:
could not verify access to this app right now; try again shortly
Telebroad could not look up the app or your role just now. It is not a decision about your access.
Who fixes it. Nobody. Try again in a minute. If it keeps happening, contact support.
Where. Start the sign-in from your app again.
Access was revoked
What it means. Your app was connected, then stopped working: /token answered
400 with invalid_grant. The cause is the connection, the app, the user's role
or an expired refresh token, and each has its own section on the next page.
Who fixes it. It depends on the cause.
Where. Handling revoked access.