Skip to main content
If sign-in fails, return to Workspaces and select Log in again. Do not reload or reuse an /auth/callback URL. A repeated 401 unauthorized after the provider screen usually needs an operator to correct the sign-in setup. Hosted Workspaces uses AuthKit with Google, GitHub, Microsoft, Apple, and email magic links. A self-hosted instance uses the OIDC provider or Cloudflare Access chosen by its operator.

​
Fix common sign-in results

If sign-in succeeds but a workspace is still missing, review personal and organization workspaces. Workspace ownership, organization membership, guest links, and visibility still decide what the account can open.

​
Check hosted AuthKit

These checks require the hosted Workspaces operator:
  1. Confirm that Google, GitHub, Microsoft, Apple, and email magic links are enabled in the intended AuthKit environment.
  2. Confirm that the WorkOS client ID and API key belong to the same WorkOS application and environment. A mismatch can let the provider screen finish before Workspaces returns 401 unauthorized. Operator logs report invalid_client for this case.
  3. Register the app origin followed by /auth/callback as the redirect URI. Set the sign-in endpoint to the same origin followed by /auth/login.
  4. Set the app homepage and sign-out return to the app origin.
  5. Keep the session-cookie key stable across deployments. Rotating it signs out existing browsers; those users must sign in again.
Do not put a WorkOS API key, session-cookie key, callback code, or session value in a support message or screenshot.

​
Check a self-hosted OIDC login

The instance operator should check these items:
  1. The public app origin is the address the browser uses.
  2. The identity provider registers that origin followed by /auth/callback.
  3. The self-host organization ID and name are set.
  4. The issuer is reachable and serves valid OpenID Connect discovery data. In production, the issuer and every endpoint in that data must use HTTPS.
  5. The client ID and, for a confidential client, the client secret match the provider registration. If you set a client secret, the provider must accept it in the token request form (client_secret_post). Workspaces does not send it with HTTP Basic authentication.
  6. The ID token contains a subject and email address.
  7. The Workspaces OIDC session key is at least 32 bytes.
If Log in fails before the provider screen opens, inspect the server logs. A line that starts with OIDC discovery failed for issuer means the issuer could not be reached or returned an error. Correct the issuer setting or the server’s network access. Invalid discovery data or a mismatch between the configured issuer and the issuer in the discovery data also stops sign-in before the callback. Workspaces returns 401 unauthorized for a missing callback code, a changed state value, a failed token exchange, a wrong issuer or audience, or a missing subject or email. Start a fresh login after the operator corrects the setup. If the provider has no logout endpoint, Sign out clears the Workspaces session but may leave the provider session active.

​
Check Cloudflare Access

Cloudflare Access handles sign-in before a browser request reaches Workspaces. Workspaces does not create its own login session in this mode. The operator should confirm that:
  • the Access application covers the app’s custom domain;
  • an allow policy includes the person signing in;
  • Access sends its assertion with every request to the browser app domain;
  • the configured Access team domain and application audience match the assertion; and
  • the self-host organization ID and name are set.
A missing Access assertion on the browser app domain makes Workspaces treat the request as signed out. If the assertion is present but invalid, Workspaces returns 401 unauthorized. The Access login flow needs a custom domain; the default Worker development address does not support this setup. Tools and agents send Workspaces API keys to the separate public API domain, which must stay outside Access.

​
Sign out and revoke access

In hosted AuthKit or OIDC mode, Sign out clears the Workspaces browser session. In Cloudflare Access mode, Sign out opens Cloudflare’s logout address because Cloudflare Access manages the browser session. Signing out does not revoke API keys. Before an operator disables a person’s account at the sign-in provider, that person should revoke each key under Settings > API keys. If the operator disabled the account first, they must restore sign-in long enough for the key owner to revoke the keys. Sign in and sign out covers the normal browser steps. Create and revoke API keys explains how to end automation access. Reviewed July 20, 2026. Maintained by the Plannotator documentation team.
Last modified on July 24, 2026