Troubleshooting

Troubleshooting

“Login keeps redirecting back to login”

The Accounts sign-in cookie is host-only — it belongs to the Accounts origin alone. A login loop almost always means the cookie isn’t being stored or sent back:

• Make sure third-party (or all) cookies aren’t blocked for account.destesi.io in your browser.
• If you’re using a privacy extension or an aggressive content blocker, allow the Accounts origin.
• Try a fresh private window to rule out a stale or conflicting cookie.

If a single product (not Accounts itself) bounces you to login repeatedly, your product session may have failed to validate. Sign out and back in to re-run the single sign-on handoff.

Signup fails

Message	Cause	Fix
email_taken	An account with that email already exists.	Sign in instead, or use the password-reset flow.
invalid_input — “password must be at least 12 characters”	Password too short.	Choose a password of 12+ characters.
invalid_input — email required	Email missing or malformed.	Enter a valid email address.

Can’t create or rename a workspace

• slug_taken — a workspace with that slug already exists across Destesi. Workspace slugs are globally unique; pick a different name (the slug is derived from it) or a different slug.

Remember: you already have a personal workspace from signup, so you don’t need to create one to start working.

Two-factor authentication

I don’t have my authenticator app. During sign-in, you can enter one of your backup codes instead of a TOTP code. Each backup code works once.

I’ve lost both my authenticator and my backup codes. You’re locked out of 2FA-gated sign-in and can’t recover it yourself — contact your workspace owner or Destesi support to regain access.

Setup won’t activate. Activation requires a current code from your authenticator. If it keeps failing, confirm your device clock is accurate (TOTP is time-based) and try the next code.

After turning on 2FA, login returns no session. That’s expected — with 2FA enabled, login returns a challenge first. Complete it with a TOTP or backup code to finish signing in.

Password reset link doesn’t work

• Reset links are single-use and time-limited. If you clicked an old link or already used one, request a fresh reset.
• invalid_token means the link is expired, already used, or malformed — request a new one.
• For security, requesting a reset always reports success even for an unknown email, so a non-arriving email may simply mean no account exists for that address. Check the address and your spam folder.
• Resetting your password signs out your other sessions; you’ll need to sign in again elsewhere.

API tokens

I lost my token value. The full token is shown exactly once, at creation. It can’t be retrieved later — revoke the lost token and mint a new one.

My token returns “expired.” Tokens with an expiry set (1–730 days) stop working past that date. Mint a new one; omit the expiry for a non-expiring token if appropriate.

A token can’t write. Check its scope — a read (read-only) token can’t perform writes. Mint a write-scope token for read-write access.

I revoked a token but a client still seems to work. Revocation propagates within a short cache window. Wait about a minute and retry; the client should then be rejected.

CLI sign-in (dst login)

• dst login opens an approval page in your browser. If nothing opens, copy the URL the terminal prints and open it manually.
• “Missing ?code=” on the approval page means the link is stale — run dst login again to get a fresh one.
• If the approval page sends you to sign in first, you simply aren’t signed into Accounts in that browser yet; sign in and the approval resumes.
• After approving, run dst whoami to confirm. If it fails, run dst logout and dst login again.

See CLI & API authentication for the full device-login flow.

Switching workspaces doesn’t take effect everywhere

Your active workspace travels with your session. If a product still shows the old workspace after you switch:

• Reload the product page so it re-reads your active workspace.
• Make sure you actually set the active workspace (not just viewed it) in Accounts.

Note

Still stuck? The health endpoints GET /healthz and GET /readyz confirm the service is up and its database is reachable. If those fail, the issue is service-side, not your account.