Troubleshooting
Start from what you observe. KEYRA docs connect symptoms to causes, fixes, error codes, SDK methods, and API endpoints.
On this page
What are you having trouble with?
OAuth VerifyTrust boundary, validate, sessions, exchange failures.Partner 2FAEnrollment, challenges, verification tokens, disable behavior.Credentials401s, browser vs server keys, sandbox/prod mix.Popup & RedirectBlocked popups, callbacks, redirect_uri exact match.PKCEVerifier loss, async vs sync helpers, invalid_grant.Network & HTTP400/401/403/404/409/429/5xx in KEYRA context.ProductionWorks locally, fails in production.Error codesLook up invalid_client, verification_token_already_used, and more.
Common symptoms
- Enrollment stays pending
- User is reported as not enrolled
- Challenge stays pending
- Verification token is missing / disappeared
- User approved but application does not continue
- Disable 2FA succeeded but an existing challenge still works
- 401 calling Partner 2FA
- KEYRA popup does not open
- KEYRA says success but my user isn't logged in
- OAuth redirect never returns
- redirect_uri is rejected
- PKCE validation fails
- Authorization code cannot be exchanged
- Token exchange succeeds but validation fails
- Works locally but fails on production domain
- Using client secret in the browser
- 429 from KEYRA API
- 5xx from KEYRA API
- 409 conflict errors
Have an error code?
Jump to the error catalog. Frequently searched: