Practical fixes for the most common problems, organized by what you’re
seeing. Every action mentioned here is recorded in your organization’s
audit log, so if something you didn’t expect
happened, that’s the first place to check who did it and when.
| Symptom |
Likely cause |
What to check |
| “Invalid credentials” on email/password sign-in |
Wrong password, or the account uses SSO/social sign-in only |
Use Forgot password? to reset it, or try signing in with Google/Microsoft if that’s how the account was created |
| Redirected back to sign-in after choosing your organization’s SSO option |
Your organization’s SSO isn’t fully configured yet, or you picked an identity provider your organization hasn’t actually set up |
Ask an organization Owner or Admin to confirm SSO is enabled and which provider it’s configured for - see SSO |
| Asked for a 2FA code that no longer works, or you’re locked out after several failed attempts |
The code expired (codes are time-limited, usually 30 seconds), or you’ve hit a temporary lockout after repeated wrong attempts |
Wait for a fresh code from your authenticator app; a repeated-failure lockout clears itself after a short wait rather than staying locked permanently |
| Lost your authenticator app entirely |
Two-factor authentication can’t be disabled without a valid code from that device |
Contact support - there’s no self-service recovery for this |
| “Account is not fully set up” or similar after signing in |
Your profile is missing required fields (name/surname) |
Complete the profile form you’re redirected to - it only appears once |
See FAQ and Account security.
| Symptom |
Likely cause |
What to check |
| Invitation link says it’s invalid or expired |
The invitation was revoked, already accepted, or expired |
Ask the Owner/Admin who sent it to check its status and resend if needed |
| Signed in but not seeing the organization |
The invitation was accepted with a different email address than the one it was sent to, or wasn’t accepted at all |
Confirm which email received the invitation, and that you actually completed the accept step rather than just following the link |
| Accepted the invite but access seems limited |
A pending invitation grants no access - only an accepted one does, and your role only takes effect once it’s accepted |
Check your role in the organization’s member list |
See Organizations & teams.
| Symptom |
Likely cause |
What to check |
| Validation reports “Invalid” |
Wrong key/secret value, a revoked or rotated token, or insufficient permissions on the credential |
Compare against Credential permissions, regenerate the credential at the provider if you’re unsure it’s still valid |
| Credential stuck on “awaiting validation” |
Saving a credential doesn’t automatically validate it |
Click Validate on the credential’s row |
| Credential was valid, now everything using it fails |
The provider-side key was rotated or revoked outside Sencai |
Add a fresh credential with the new value and remove the old one - an existing credential’s secret can’t be edited in place |
See Connect a cloud provider.
| Symptom |
Likely cause |
What to check |
| Scan completes but the inventory is empty |
The credential is read-scoped too narrowly for the resource types you expected, or genuinely has no resources in the region(s) it can see |
Review what permissions the credential actually has against Credential permissions |
| Scan never seems to run |
Automatic scanning wasn’t turned on for that credential, and no manual scan has been triggered yet |
Trigger a manual scan, or enable automatic scanning on the credential |
| Some resources show up, others don’t |
Different resource types can need different permissions on some providers |
Check the credential covers the specific resource type that’s missing |
See Import existing infrastructure.
| Symptom |
Likely cause |
What to check |
| Instance stuck in Provisioning |
The provider is taking longer than usual, or a step is genuinely failing silently upstream |
Give it a few minutes; if it doesn’t resolve, check the instance’s activity log for the specific failing step |
| Instance moved to Error |
The provider rejected the request (quota exceeded, invalid region/size combination, credential permissions) |
Read the error detail on the instance - it’s the provider’s own message, not a generic failure |
| Provisioning never starts at all |
No cloud account is connected or selected, or the selected credential isn’t validated |
Confirm a validated credential is connected - see Connect a cloud provider |
See Provision & manage instances.
| Symptom |
Likely cause |
What to check |
| Enrollment command fails |
The enrollment token was already used, expired, or belongs to a different organization |
Generate a fresh enrollment token from the fleet agent settings - tokens are single-use |
| Enrollment fails to reach Sencai at all |
Outbound network access from the server is blocked |
Confirm the server can make outbound HTTPS connections - the agent never needs an inbound port opened |
| Agent enrolled but shows Offline |
The agent process stopped, the host lost network connectivity, or its connection is blocked after enrollment |
On the server, check the agent service is running (for example systemctl status sencai-agent) and that outbound connectivity is still available |
| Agent is online but not reporting a capability you expect (inventory, patch status, and so on) |
That capability hasn’t been granted to the agent |
An organization admin needs to enable the specific capability from the agent’s settings |
See Install & enroll an agent.
| Symptom |
Likely cause |
What to check |
| No terminal option on a host you manage |
The host isn’t registered in your organization as a cloud instance - the terminal is an instance feature, not a fleet-agent feature |
Register or import it as a cloud instance; see Provision & manage instances and the prerequisites in Browser terminal |
| Terminal control is present but disabled on an instance |
The instance isn’t in a state the terminal can reach (only a running or imported instance qualifies), or the instance record has no address to connect to |
Wait for it to reach Running; for an imported instance, have an admin set the connection details on the instance record |
| Terminal opens but the session never connects |
The platform’s access hasn’t been set up on the target host yet, or its SSH port isn’t reachable from Sencai |
See the caution in Browser terminal; contact support if it should work and doesn’t |
| Terminal connects, but you get a permission error |
Your organization role doesn’t include terminal access |
Check your role - see Roles & permissions |
See Browser terminal.
| Symptom |
Likely cause |
What to check |
401 Unauthorized |
The token is missing, malformed, expired, or was revoked |
Confirm you’re sending the token as a bearer credential, and that it hasn’t been revoked from your organization’s API tokens settings |
403 Forbidden on every call, read or write |
The token’s issuer left the organization or was demoted below Admin, or the organization was deleted |
Have a current Admin or Owner generate a fresh token - see the full table in API tokens |
403 Forbidden specifically on a write/mutating call |
The token is read-only; or it’s read/write but the organization’s AI-agent write access toggle is off, or the organization is suspended for non-payment |
Confirm the token has write scope and that an Owner or Admin has turned write access on - see API tokens |
See API tokens and AI agents.
| Symptom |
Likely cause |
What to check |
| No deliveries arriving for a real event (an instance provisioned, drift was detected, and so on) |
Automatic dispatch for these event types isn’t live yet - registering an endpoint and choosing events works, but the platform doesn’t yet call your endpoint when the event happens |
Use Test on the webhook’s row to confirm your endpoint works; see the note in Webhooks |
| A Test delivery fails |
The endpoint isn’t reachable from Sencai, or returned a non-2xx status |
Confirm the endpoint is publicly reachable over HTTPS, then check the HTTP status code for that delivery on the Webhook Delivery Log screen |
| Signature verification fails on your end |
Using the wrong signing secret, or verifying against the raw body incorrectly |
Re-check the signing secret shown on the webhook’s settings against what your endpoint is configured with |
See Webhooks.
| Symptom |
Likely cause |
What to check |
| A resource exists but shows no cost |
Cost data for that resource hasn’t been ingested yet, or the resource type/provider doesn’t report cost data the way Sencai expects |
Give it a billing cycle to appear; confirm the credential has the permissions needed for cost data on that provider |
| Costs look wrong or incomplete for the period |
You’re looking at a partial billing period, or resources are missing cost-allocation tags |
Check the date range you’re viewing, and see Cost allocation for tagging |
| Nothing shows up for an entire connected account |
The credential itself may not be validated, or has no cost-read permission |
See Cloud credential validation fails above |
See Costs.
| Symptom |
Likely cause |
What to check |
| No email notifications at all |
Your email preferences have that category turned off, or the address bounced |
Check your notification preferences in your profile settings |
| No notifications in a channel like Slack/Teams |
The integration channel isn’t configured, or its endpoint has been failing |
Check the channel’s status in your organization’s notification settings - a repeatedly failing channel can be paused automatically |
| Some events notify you, others don’t |
Notification categories are configured individually |
Check which categories are enabled for the channel or your personal preferences |
See Notifications.
- FAQ - shorter, common questions
- Glossary - unfamiliar terms
- Support - if none of the above resolves it