> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/help/troubleshooting/sign-in-fails.md).

# Sign-in fails or the session expired

Fix Devolutions CLI sign-in errors and expired sessions for Devolutions Cloud and Devolutions Server, from the error code the command shows.

`devo login` stops with an error, or a command that used to work now says you need to sign in. The error code at the start of the message tells you which case you're in.

## Why it happens

* No context is selected, or the selected context has no sign-in information.
* The browser session expired and can't be renewed.
* The environment variable or file that holds your application secret, API key, or password isn't available.
* The key, secret, or password is wrong.
* The sign-in method doesn't suit the computer, for example a browser sign-in on a computer without a browser.
* Devolutions Cloud or Devolutions Server didn't answer in time.

## Check where you stand

Before you change anything, see what Devolutions CLI knows about the current context:

```bash
devo status
```

It shows the context, its kind, and, for Devolutions Cloud or Devolutions Server, whether sign-in information is stored. It doesn't contact the workspace. To test the sign-in for real, add `--online`:

```bash
devo status --online
```

To check another context, add its name: `devo status <context-name>`.

## Fix it

{% stepper %}
{% step %}

### Select the right context

<table><thead><tr><th width="300">ERROR CODE</th><th>WHAT TO DO</th></tr></thead><tbody><tr><td><code>contextNotFound</code></td><td>No current context, or no context with that name. Run <code>devo context list</code>, then <code>devo context use &#x3C;context-name></code>, or sign in with <code>devo login</code>.</td></tr><tr><td><code>cloudAuthenticationRequired</code><br><code>serverAuthenticationRequired</code></td><td>The context has no sign-in information, for example after <code>devo logout</code>. Sign in again with <code>devo login</code>.</td></tr><tr><td><code>contextAmbiguous</code></td><td>Two contexts of different kinds share the name. Delete one with <code>devo context delete &#x3C;context-name> --kind &#x3C;kind></code>.</td></tr></tbody></table>

See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).
{% endstep %}

{% step %}

### Sign in again when the session expired

A browser sign-in (`--oauth`) gives Devolutions CLI a session that it renews by itself. When that's no longer possible, you see one of these codes:

* `cloudOAuthSessionExpired`, `cloudOAuthRefreshFailed`
* `serverOAuthSessionInvalid`, `serverOAuthRefreshFailed`

Sign out, then sign in again with the same context name. The context is updated, and your scripts and references keep working:

```bash
devo logout <context-name>
devo login <context-name> --cloud https://<your-organization>.devolutions.app --oauth
```

For Devolutions Server, use `--server https://<your-server-address>` instead of `--cloud`.

`cloudOAuthRefreshBusy` or `serverOAuthRefreshBusy` means another `devo` command was renewing the same session for more than 60 seconds. Wait for it to finish, then run your command again.
{% endstep %}

{% step %}

### Make the secret available again

When you sign in with an application key (Devolutions Cloud), an API key or a password (Devolutions Server), the context remembers **where** the secret is, the environment variable or the file you named, not the secret itself. Devolutions CLI reads it again whenever it needs it.

`secretReferenceUnavailable` means that variable isn't set, or that file can't be read, at the moment of the command. Set the variable in the terminal, script, or pipeline that runs the command, or restore the file.

The background process reads the variable from its own environment, so after you set it, restart the process from that same terminal:

```bash
devo daemon restart --wait
```

See [Sign in from a CI pipeline](/cli/for-devops-and-administrators/automate/ci-sign-in.md).
{% endstep %}

{% step %}

### Check the credentials

<table><thead><tr><th width="300">ERROR CODE</th><th>WHAT TO DO</th></tr></thead><tbody><tr><td><code>cloudAuthenticationFailed</code></td><td>The application key or application secret is wrong, or the application was denied. Check both in Devolutions Cloud, then sign in again.</td></tr><tr><td><code>serverAuthenticationFailed</code></td><td>Devolutions Server refused the API key, user name, or password. Check them, and the domain if you use <code>--domain-id</code>, then sign in again.</td></tr><tr><td><code>invalidParameterValue</code> during <code>devo login</code></td><td>The options don't fit together, for example Devolutions Server options with <code>--cloud</code>, or a context name already used by another kind of context. The message names the problem.</td></tr></tbody></table>
{% endstep %}

{% step %}

### Pick a sign-in method that suits the computer

<table><thead><tr><th width="300">ERROR CODE</th><th>WHAT TO DO</th></tr></thead><tbody><tr><td><code>cloudOAuthLoopbackUnsupported</code><br><code>serverOAuthLoopbackUnsupported</code></td><td>The browser sign-in isn't offered. On Devolutions Server, add <code>--use-device-code</code> to <code>devo login</code> and follow the instructions in the terminal. On Devolutions Cloud, sign in with an application key instead.</td></tr><tr><td><code>cloudOAuthLoopbackUnavailable</code><br><code>serverOAuthLoopbackUnavailable</code></td><td>Devolutions CLI couldn't start the local listener that receives the browser's answer. Try again. On Devolutions Server, you can also use <code>--use-device-code</code>; on Devolutions Cloud, an application key.</td></tr><tr><td><code>cloudOAuthAuthorizationExpired</code><br><code>serverOAuthAuthorizationExpired</code></td><td>You didn't finish signing in in the browser in time. Run <code>devo login</code> again.</td></tr><tr><td><code>cloudOAuthAccountKeyMissing</code></td><td>This Devolutions Cloud session can't open vault data. It happens with a session from <code>--use-device-code</code>. Sign in again with the browser flow, <code>--oauth</code> without <code>--use-device-code</code>, or with an application key.</td></tr><tr><td><code>windowsAuthenticationUnsupported</code></td><td><code>--windows-auth</code> works on Windows only. Use another sign-in method on macOS and Linux.</td></tr></tbody></table>

See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md) and [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md).
{% endstep %}

{% step %}

### Give the workspace more time

`cloudRequestTimeout` or `serverRequestTimeout` means Devolutions Cloud or Devolutions Server didn't answer in time. Check that you can reach the address from this computer, for example through a VPN or a proxy. If the workspace is just slow, raise the time limit of `devo login` with `--timeout`, in seconds, from 3 to 600. The default is 15.

```bash
devo login <context-name> --server https://<your-server-address> --oauth --timeout 60
```

{% endstep %}
{% endstepper %}

{% hint style="info" %}
`devo logout` clears the stored sign-in of a context but keeps the context itself. To remove the context too, use `devo context delete <context-name> --yes`.
{% endhint %}

## Still failing?

Run the command again with `--verbose`, then [collect diagnostics](/cli/help/troubleshooting/collect-diagnostics.md) and contact [Devolutions support](https://devolutions.net/support/). Never send your key, secret, or password.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/help/troubleshooting/sign-in-fails.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.