> ## Documentation Index > Fetch the complete documentation index at: https://help.plannotator.ai/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshoot Sign-In to Workspaces > Fix hosted AuthKit, self-hosted OIDC, Cloudflare Access, callback, cookie, and sign-out problems in Workspaces. If sign-in fails, return to Workspaces and select **Log in** again. Do not reload or reuse an `/auth/callback` URL. A repeated `401 unauthorized` after the provider screen usually needs an operator to correct the sign-in setup. Hosted Workspaces uses AuthKit with Google, GitHub, Microsoft, Apple, and email magic links. A self-hosted instance uses the OIDC provider or Cloudflare Access chosen by its operator. ## Fix common sign-in results | Result | What to do | | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A hosted sign-in option is missing | A browser setting cannot add a missing method. The hosted operator must enable all five methods in that AuthKit environment. Use the same method each time. To switch accounts, sign out of the provider first. | | `401 unauthorized` after the provider screen | Return to Workspaces and select **Log in** again. Allow site cookies and finish the new attempt in the same browser. If it fails again, use the matching operator checks below. | | Workspaces opens the signed-out page again | The session was missing, invalid, expired, or created before the operator changed the session-cookie key. Select **Log in** to create a new session. | | **Couldn't reach Workspaces** | Select **Try again**. If the error returns, check the network. The operator should also check that the Workspaces service, `/v1/auth/config`, and `/v1/me` respond. | | **Log in** returns to the wrong account | Sign out of Workspaces, then sign out of the sign-in provider. Start sign-in again. The provider may otherwise reuse its active session. | | You accepted an invitation but the team is missing | Open **Settings** > **Account** and check **Signed in as**. Sign out and back in with the invited account. Workspaces refreshes hosted organization memberships during sign-in. | If sign-in succeeds but a workspace is still missing, review [personal and organization workspaces](/workspaces/accounts/personal-and-organization-workspaces). Workspace ownership, organization membership, guest links, and visibility still decide what the account can open. ## Check hosted AuthKit These checks require the hosted Workspaces operator: 1. Confirm that Google, GitHub, Microsoft, Apple, and email magic links are enabled in the intended AuthKit environment. 2. Confirm that the WorkOS client ID and API key belong to the same WorkOS application and environment. A mismatch can let the provider screen finish before Workspaces returns `401 unauthorized`. Operator logs report `invalid_client` for this case. 3. Register the app origin followed by `/auth/callback` as the redirect URI. Set the sign-in endpoint to the same origin followed by `/auth/login`. 4. Set the app homepage and sign-out return to the app origin. 5. Keep the session-cookie key stable across deployments. Rotating it signs out existing browsers; those users must sign in again. Do not put a WorkOS API key, session-cookie key, callback code, or session value in a support message or screenshot. ## Check a self-hosted OIDC login The instance operator should check these items: 1. The public app origin is the address the browser uses. 2. The identity provider registers that origin followed by `/auth/callback`. 3. The self-host organization ID and name are set. 4. The issuer is reachable and serves valid OpenID Connect discovery data. In production, the issuer and every endpoint in that data must use HTTPS. 5. The client ID and, for a confidential client, the client secret match the provider registration. If you set a client secret, the provider must accept it in the token request form (`client_secret_post`). Workspaces does not send it with HTTP Basic authentication. 6. The ID token contains a subject and email address. 7. The Workspaces OIDC session key is at least 32 bytes. If **Log in** fails before the provider screen opens, inspect the server logs. A line that starts with `OIDC discovery failed for issuer` means the issuer could not be reached or returned an error. Correct the issuer setting or the server's network access. Invalid discovery data or a mismatch between the configured issuer and the issuer in the discovery data also stops sign-in before the callback. Workspaces returns `401 unauthorized` for a missing callback code, a changed state value, a failed token exchange, a wrong issuer or audience, or a missing subject or email. Start a fresh login after the operator corrects the setup. If the provider has no logout endpoint, **Sign out** clears the Workspaces session but may leave the provider session active. ## Check Cloudflare Access Cloudflare Access handles sign-in before a browser request reaches Workspaces. Workspaces does not create its own login session in this mode. The operator should confirm that: * the Access application covers the app's custom domain; * an allow policy includes the person signing in; * Access sends its assertion with every request to the browser app domain; * the configured Access team domain and application audience match the assertion; and * the self-host organization ID and name are set. A missing Access assertion on the browser app domain makes Workspaces treat the request as signed out. If the assertion is present but invalid, Workspaces returns `401 unauthorized`. The Access login flow needs a custom domain; the default Worker development address does not support this setup. Tools and agents send Workspaces API keys to the separate public API domain, which must stay outside Access. ## Sign out and revoke access In hosted AuthKit or OIDC mode, **Sign out** clears the Workspaces browser session. In Cloudflare Access mode, **Sign out** opens Cloudflare's logout address because Cloudflare Access manages the browser session. Signing out does not revoke API keys. Before an operator disables a person's account at the sign-in provider, that person should revoke each key under **Settings** > **API keys**. If the operator disabled the account first, they must restore sign-in long enough for the key owner to revoke the keys. [Sign in and sign out](/workspaces/accounts/sign-in-and-sign-out) covers the normal browser steps. [Create and revoke API keys](/workspaces/agents/api-keys) explains how to end automation access. *Reviewed July 20, 2026. Maintained by the Plannotator documentation team.*