Signing in and access
Fixes for signing in, joining an organization, and what your role lets you do.
Email or password is incorrect
You see: That email or password is incorrect. Please double-check and try again.
Cause: The email and password pair did not match an account. The message is the same whether the email is unknown or the password is wrong.
Fix: Check the email and the password. If the sign-in page shows Forgot password?, use it. That link appears only when password sign-in is on for your install. If it does not appear, ask your admin to reset your password. Admins and owners can do this for members.
Your session has expired
You see: Your session has expired. Please sign in again.
Cause: Your sign-in token is no longer valid or has run out.
Fix: Sign in again. If sign-in works but you land on a page that says no active organization, see the entry on that page below.
Marshal cannot be reached
You see: In the web app, Cannot reach Marshal. Check your network, VPN or Tailscale, then retry. You are still signed in. From the CLI, Could not reach <address> followed by Check your network, VPN or Tailscale, then retry. Your login is kept.
Cause: Your computer could not reach your Marshal address, for example because the VPN or Tailscale is off, or DNS or a proxy failed. Your sign-in is still valid.
Fix: Reconnect your network or VPN, then retry. You do not need to sign in again.
The CLI is not logged in
You see: no server configured or not logged in
Cause: The CLI has no saved server address, or no valid login. The first time you use it, it does not know your Marshal address.
Fix: Run marshal login --server https://<your-marshal-host>. Marshal saves the address, so later you can run marshal login alone. See the CLI reference.
The browser does not open when I run marshal login
You see: A notice that marshal login is using device login because no display was found, followed by a link and a code.
Cause: The machine has no display, which is typical for SSH sessions and servers. The CLI uses device login there, so you sign in from a device that has a browser.
Fix: Open the printed link on your laptop or phone, check the details, and choose Approve. To force device login on any machine, run marshal login --device. If you do have a display and want the browser, run marshal login --browser.
The login code expired
You see: login expired in the terminal, or Code expired or not found on the approval page.
Cause: A device login request is valid for 10 minutes. After that, or once it has been used, the code stops working.
Fix: Run marshal login --device again for a fresh link and code. If you typed the code, check it against your terminal.
The device login was denied
You see: login denied in the terminal and Request denied on the approval page.
Cause: The request was denied on the approval page.
Fix: Run marshal login --device again and choose Approve on the page.
Too many login attempts
You see: too many login attempts from this network in the terminal, or Too many attempts on the approval page.
Cause: Marshal limits how many device login requests and code checks one network or account can make in a short time.
Fix: Wait a few minutes, then try again. On the approval page, copy the code exactly as the terminal shows it.
This server does not support device login
You see: this server does not support device login
Cause: The Marshal server you are signing in to is on an older version that has no device login.
Fix: Sign in with your email and password: marshal login --password. If the CLI chose device login on its own and you have a browser available, marshal login --browser works too. Your admin can upgrade the server to turn device login on.
Registration needs an invitation
You see: Open registration is disabled. Ask your admin for an invite link. or This workspace requires an invitation. Ask your admin for an invite link.
Cause: Accounts on this install are created by invitation.
Fix: Ask an admin or owner for an invitation link. Open the link while signed out, then choose Create account. From the CLI, pass the link instead: marshal register --invite <link>.
The invitation page is unavailable
You see: Invitation unavailable
The page shows one of four lines. Each has a different cause.
| Line | Cause | Fix |
|---|---|---|
This invitation has expired. | The link is past its expiry date. | Ask an admin for a new link. |
This invitation has already been used. | An invitation link works once. Someone, maybe you, already accepted it. | Sign in. If the account is not yours, ask for a new link. |
This invitation has been revoked by the admin. | An admin cancelled the link. | Ask the admin for a new one. |
This invitation is not valid. | The link is wrong or cut short. | Copy the full link again from the admin. |
If the page shows Invalid link with No invitation token in the URL., the link lost its token part. Ask for the link again.
An invitation grants the role the admin chose, either admin or member. It never grants owner. An owner can promote you later.
I was invited but no email arrived
You see: No invitation email in your inbox.
Cause: Invitation emails need email set up for your organization. Without it, Marshal still creates the invitation and shows Email is not set up for this organization, so no email was sent. Marshal also limits invitation emails per hour and shows Too many invitation emails were sent this hour, so no email was sent. Share the link yourself.
Fix: The admin copies the invitation link from the Members page and sends it to you. Admins set up email in Settings, Email.
No active organization
You see: No active organization
Cause: You are signed in but you belong to no organization. This happens after you leave or are removed from your last one.
Fix: Open an invitation link from an admin to join one. You can also choose Create your organization. If that button is disabled with Creating organizations is turned off by policy on this deployment. Ask an administrator., your administrator manages organizations for this install. Open an invitation link to join one.
A button is missing or returns 403
You see: A button is greyed out or missing, or an action fails with 403.
Cause: Your role does not allow the action. For example, only admins and owners can install marketplace packages, invite people, and create API keys. Only owners can change roles, rename the organization, or delete it. A role change takes effect on your next action, and you stay signed in.
Fix: Look up the action in Roles and permissions. Ask an admin or owner to do it, or to change your role.
This feature is not enabled
You see: A page that says This feature is not enabled, or a greyed-out entry in the left rail or in settings with the tooltip Not enabled. From the CLI or the API, This feature is not enabled. Ask an admin to turn it on in Settings.
Cause: Your organization has this feature switched off. Deputies and runs, webhooks, and the Slack connection each have their own switch.
Fix: An admin or owner opens Settings > Platform, turns on Deputies and runs, Webhooks or Slack and OAuth sign-in, and selects Save changes. The feature opens right away. If the card says the installation has no license, or that the license does not include the feature, the switch cannot turn it on. Your operator adds the installation license, or your Marshal contact updates it.
Service unavailable, try again
You see: An error service unavailable on a page such as Runs or Deputies. From the API, a
503 with This organization's settings could not be read just now. Try again in a moment. and
a Retry-After header. From an AI agent using Marshal’s MCP tools, a refusal that says the
organization’s settings could not be read and to try again.
Cause: Marshal could not check your organization’s settings in time, usually during a short spike in database load. Your features keep their settings.
Fix: Try again in a few seconds. If it keeps happening, tell your operator, who can check the API’s database.