Troubleshooting

Each entry is a symptom, what it means, and the fix.

Gatekeeper

DENIED — verified, but policy: the built-in pin policy (gatekeeper.default) denied, exit 3. Every cryptographic check passed; the deployment's digest is not pinned. On a first run that is expected: confirm the pin in gatekeeper endpoint trust add router --from-upstream. On a running Gatekeeper it means the router redeployed: run gatekeeper endpoint discover router, read what changed, and pin the new digest. See Connect.

not in the Super Protocol trusted registry. The cloud's root verified against the hardware vendor but its measurement carries no Super Protocol signature: a local or test build. Not the production router. See Test or unsigned builds.

Exit 4: the configuration is missing, invalid or unfinished. Run gatekeeper config validate; it lists every problem by path. An endpoint with an empty trustedEvidence list is the usual one. gatekeeper run is the only command that refuses an unfinished file.

gatekeeper status exits 69. No admin: section in the configuration; add one and reload with SIGHUP. See Headless and containers.

A request through Gatekeeper answers 503 gatekeeper_error. The body's stage says which check failed; the table is on Vocabulary. tls-fingerprint right after the router rotated its certificate clears on the next re-attestation, within the verdict cache TTL of 60 seconds.

$ gatekeeper: command not found after the install script. The script said which directory it installed into and printed the export PATH=… line to add. Run it, or open a new shell.

The API

401 invalid_api_key. The key is missing or mistyped. Send it as Authorization: Bearer sk-tee-v1-…. The production router's exact answer is on Errors and limits.

401 api_key_revoked or api_key_expired. The key was revoked on API Keys, or its Expires date passed. Create a new one.

402 insufficient_credits. The workspace balance would go below zero. See Credits. 402 key_spend_limit_reached is the key's own ceiling; raise it under Edit limits and scope.

403 model_not_in_key_scope. The key is restricted to specific models and this is not one of them. Edit the key's Model scope.

404 model_not_found, or a model is missing from /v1/models. Either the id is wrong (take it from Models), or the model is served by an external endpoint whose verdict is pending or denied. A model whose endpoint holds no verdict is absent from the list rather than listed and broken. See External model endpoints.

429 rate_limit_exceeded. One of the four minute buckets is empty. Wait Retry-After seconds. The per-key buckets are on the key; the workspace buckets are the deployment's. See Errors and limits.

503 attestation_failed from the router itself. The model runs on an endpoint this router does not currently admit, so nothing was sent. It is not something you can clear from your side: whoever runs the deployment has to approve that endpoint again. 503 attestation_revoked ended a stream because the verdict was withdrawn while it was running; the tokens already delivered are metered and retrying will not help until the endpoint is admitted again.

A stream stops after [DONE] and the SDK closes the connection. That is correct behaviour; the generation is metered ok.

Signing in and invitations

No code arrives. Check spam first. An address is mailed only a limited number of codes an hour, so a new one may not arrive straight away. The router answers "sent" whatever happened, so that a stranger learns nothing about the address. A deployment that cannot send mail at all says so on its sign-up screen: Registration by email is not available on this deployment.

"That code is not right." Check the mail and try again, or send a new one. A code already used answers the same way.

"That code no longer works. Send a new one." The code expired, or was guessed wrong too many times.

"Too many attempts. Wait a minute and try again." The per-address budget for asking for or trying codes.

"You need an invitation to create an account here." The deployment is invite-only and the sign-up carried no code. Open the link you were sent, or paste its code under Have a code?. Signing in to an existing account still works.

"This invitation has already been claimed." An account was created with it. Sign in with that account, or ask for a new invitation.

"This invitation cannot be used." Expired, withdrawn, or mistyped. Check the link, or ask for a new one.

Signed up with an invitation but no credit arrived. The Credits screen's welcome card says why: expired, exhausted, disabled, not found, or already redeemed by this account. On an open deployment the account exists either way.

The console says it cannot reach the deployment's API. A deployment created moments ago may still be starting; Try again shortly. Otherwise the API hostname is not resolving or not serving.