Troubleshoot Account Access
Diagnose hosted sign-in, SSO, workspace selection, MFA, subscription, and connection gates with no risk to credentials.
Identity, workspace membership, MFA policy, subscription state, or necessary financial connections can block account access. Find the page and the message that you see before you change a setting.
Protect Credentials First
Never send or paste:
- password or magic-link contents
- MFA QR code, manual secret, or six-digit code
- session cookie
- OAuth access or refresh token
- API key or webhook secret
- bank login credentials
- full payment-card details
Support can investigate with the sign-in email, organization domain, workspace, time, page URL, and exact non-secret error text.
1. Find the Stage That Blocks You
| What you see | Likely stage |
|---|---|
| Sign-in page repeats | Hosted identity start or callback |
| SSO Setup Required | Organization/domain configuration |
| Create your Eigenn workspace | No active workspace membership |
| Set up two-factor authentication | MFA enrollment |
| Six-digit verification page | Workspace MFA policy or fresh sign-in verification |
| Choose the plan or Verifying subscription | Subscription gate |
| Non-dismissible Stripe and bank setup | Necessary initial connections |
| Permission error inside Settings | Role does not let you do the requested write |
Work the relevant section below. Do not create a second account or workspace until you confirm that the first one does not exist.
2. Retry the Hosted Sign-In Method
Use the same method that you used before:
- Apple
- GitHub
- email through the hosted identity flow
- company SSO
The app remembers the last used provider in the browser and marks it Last used. That hint is local to the browser, not proof of the account's identity provider.
If a protected-page link sent you to sign-in, keep the return_to destination and complete authentication in the same browser. Eigenn rejects unsafe external return destinations.
Rate-limited sign-in
The authentication start endpoint lets you make a limited number of tries in a 15-minute window. Do not try again and again. Wait for the window to clear. Then try one time.
Callback failed
If sign-in returns with an authentication-callback error:
- Start again from the Sign-in page.
- Use the same provider.
- Let the browser use the necessary cookies.
- Do not open many callback tabs at the same time.
- Record the time and the final URL if it fails again.
3. Resolve SSO Setup Required
The SSO error page appears when domain-based authentication cannot find a team or an organization that you set up.
If you are a member
Contact the organization owner. Send the company domain and the SSO error text. Do not create a separate personal workspace unless the owner directs you to.
If you are the owner
- Sign in through an available non-SSO owner identity.
- Open Settings → Account → Organizations.
- Create or select the organization.
- Confirm its company domain.
- Open the available identity administration link.
- Complete the SSO configuration there.
- Test with a non-owner user.
The workspace Security page does not set up SSO.
4. Restore Workspace Selection
Eigenn sends a new user with no membership to workspace creation. A user with more than one membership and no selected workspace must choose one. The server does not guess.
If a current user sees workspace creation unexpectedly:
- Open the Teams page if available.
- Confirm that the invitation went to the same email that you use to sign in.
- Ask an owner to check the membership and the role.
- Switch to the intended workspace.
- Reload the original page.
Workspace invitations are email-specific. If you sign in with another provider email, Eigenn can create or select a different local identity.
5. Recover MFA Access
You have no enrolled factor
When the workspace needs MFA and no factor exists, the verification flow sends you to setup.
- Generate the QR code.
- Add it to a TOTP authenticator.
- Enter the current six-digit code.
- Confirm the code.
- Return to the requested page.
Eigenn rejects a valid code
- confirm that the code belongs to the displayed account
- turn on automatic time on the authenticator device
- wait for the next code and enter it one time only
- do not reuse a code after you generate the enrollment again
You lost a device
Use another enrolled factor if one exists. After you get access again, open Settings → Account → Security. Add a replacement. Confirm it. Then remove the lost factor.
If every factor is unavailable, use public Contact. The current app does not show recovery codes or a self-service factor-reset path.
You cannot remove the last factor
The active membership is subject to the future-member MFA policy. Add another factor first.
6. Resolve Subscription Verification
Eigenn can redirect a new user without active access to plan setup. After successful checkout, subscription activation can take time to synchronize.
- Keep the checkout return page open.
- Wait for the status poll.
- Use Retry status check after its timeout.
- Compare hosted billing before you purchase again.
For an established workspace, open Settings → Billing and Manage billing. A billing restriction can permit reads but reject writes across the app.
7. Complete the Necessary Connections
Protected pages can show a setup modal that blocks you until the active workspace has:
- Stripe connected
- at least one bank connection
If one is already connected, the flow skips it. If the modal remains after both appear present:
- Confirm that both belong to the same active workspace.
- Wait for the bank account selection and the sync to complete.
- Refresh one time.
- Return to the summary and select Finish setup.
- Contact support with provider, institution, time, and page URL if the checker remains stale.
8. Diagnose Settings Permission Errors
Page visibility and write permission are separate.
- General workspace changes need Owner.
- Workspace Security changes need Owner.
- Custom email-domain lifecycle needs Owner.
- Billing delegates need Owner.
- Notification writes need Owner or Member.
- Owner or Member can do plan checkout, portal, and cancellation.
- Viewer can read team-scoped settings but cannot write them.
It is safer to switch to an owner account than to submit a visible control that the server rejects again and again.
9. Profile Email and Sign-In Identity Differ
A change to Settings → Account → General → Email updates the local Eigenn profile. It does not check or update the hosted identity provider in the same operation.
If sign-in still recognizes the old email, continue with the identity provider's address until its supported update process is complete. Ask an organization administrator for SSO identities.
10. Escalate Safely
When signed in, use Settings → Account → Support. When signed out, use the public Contact page and its published email.
Include:
- sign-in method
- profile email and company domain
- workspace name
- the page and URL that block you
- exact error message
- timestamp and timezone
- last successful access
- whether another user can enter the workspace
Do not include secrets even when asked for more detail.