Common problems

This page collects the problems people run into first with K-Block Cloud, the dashboard and the Cloud API behind it. Each entry names the symptom you see, what it means and what you can do about it.

Most entries start from an error code. Find the code in the error notice, then jump to its section. For problems with agents, the Gateway or MCP servers, see Gateway and tools. For policies and approvals, see Policies and approvals. For receipt verification, see Receipt verification.

Read the error first

Every refusal of the Cloud API has the same JSON shape:

{
  "error": {
    "code": "RATE_LIMITED",          // stable, machine-readable
    "message": "too many requests",  // human-readable
    "details": { "retry_after_seconds": 42 } // optional, depends on the code
  }
}

The dashboard shows a refusal as an error notice with:

• the API's message;
• guidance for codes the dashboard knows (for example the wait of a rate limit);
• Code: and Request ID:;
• up to 20 validation issues, each with its own code (for a 400 VALIDATION_FAILED);
• a Try again button where retrying makes sense.

The code tells you which section below applies. The request ID identifies this one request. When you contact K-Block support, give the code and the request ID: the request ID lets K-Block find exactly what happened.

For some problems on K-Block's side, which you cannot change, the notice shows no code and no message from the API. It says what happened in one of these sentences:

• "The dashboard could not reach the K-Block service. Try again in a moment." (see The dashboard cannot reach the Cloud API);
• "K-Block cannot send e-mail right now, so no message was sent." (see Verification e-mail does not arrive);
• "Plans cannot be bought or managed here right now." (on the Billing page);
• "K-Block could not complete this request because of a problem on its side." (any other such problem).

Then it says "If this keeps happening, contact K-Block support and give them the request ID below." and shows the request ID. When there is no request ID, it says "If this keeps happening, contact K-Block support and tell them when it happened." instead.

The dashboard cannot reach the Cloud API

The dashboard gets all its data from the Cloud API, the K-Block service behind it. When it cannot get an answer, the page or the action you tried shows an error notice. While your session loads, the notice is titled "Could not load your session" and has Try again.

What you can do:

1. Reload the page, or select Try again in the notice. The problem can be temporary.
2. For NETWORK_ERROR, check your own connection first: that you are online, and that your VPN or proxy lets you reach the dashboard. Then reload the page.
3. If the error continues, contact K-Block support. Tell them the time the error appeared, and give the code NETWORK_ERROR when the notice shows it.

K-Block is temporarily unavailable

When K-Block cannot handle a request safely right now, it refuses the request instead of guessing. The dashboard then shows a notice with the code 503 SERVICE_UNAVAILABLE and the API's message. For a temporary condition the notice also shows a wait, such as "Try again in 5 seconds". Programs that call the Cloud API get the same answer, with the wait in the Retry-After header.

What you can do:

1. Wait for the time the notice shows, then select Try again or reload the page.
2. If the notice comes back for more than a few minutes, or it has no wait, contact K-Block support with the code and the request ID.

Agents meet an unavailable database at the Gateway, with the code DATABASE_UNAVAILABLE: see The Gateway is unavailable.

Verification e-mail does not arrive

A new account can sign in only after its e-mail address is verified with the link from the verification e-mail. If the e-mail never arrives, the account is stuck at "Sign-in failed".

What you can do:

1. Wait a few minutes. Check your spam or junk folder, and check that the address is spelled the way you signed up with it.
2. Request a new link with Resend it (see below), then open the newest link. A new verification link replaces the earlier ones. Opening it asks for the account's password.
3. Do not resend many times in a row. Each address receives at most 10 account e-mails per hour; above that, nothing more is sent, and you get no error.

To request a new verification link, use Resend it on the sign-in page after a refused sign-in, the /resend-verification page, or Send a new verification link on your account page. Resending is limited to one request per minute and 5 requests per hour for one address. The resend answers the same way for every address, so the answer does not tell you whether the address has an account.

Sign-in is refused

Symptom. The sign-in page shows "Sign-in failed" with "The e-mail address or the password is not right — or the account's address has not been verified yet". The API code is 401 INVALID_CREDENTIALS.

Cause. The Cloud API gives one answer for every refused sign-in, so the answer does not reveal which accounts exist. Any of these produces it:

• no account has this address;
• the password is wrong;
• the account's e-mail address is not verified yet;
• the account is disabled.

Fix.

1. Check the address and the password.
2. If you signed up recently, verify the address first: click Resend it in the notice, enter the address and open the new link (see Verification e-mail does not arrive).
3. If you forgot the password, use Forgot password? to get a reset link.
4. If your account may have been disabled, contact K-Block support. Owners and admins of an organization cannot disable or re-enable an account in the dashboard.

Other sign-in problems:

Rate limits

When you exceed a limit, the Cloud API answers 429 RATE_LIMITED with a Retry-After header and details.retry_after_seconds. The dashboard shows "Too many attempts. Try again in …" with that wait, and the sign-in, sign-up and reset forms count down before they let you retry.

The default limits of the Cloud API:

If many people are refused at the same time, or sign-in to one account is locked for everyone after a few attempts, K-Block may be counting many users as one client. Contact K-Block support with the code and the request ID of one of the refusals.

The Gateway has its own limit per gateway API key: bursts of 120 requests, refilled at 20 requests per second. See Gateway and tools. For the full list of limits, see Limits and supported versions.

Setup mistakes

The Set up K-Block guide on the organization overview lists eight steps and marks each one done from the organization's real state. A step without a state could not be read. Most early problems come from a step that is not done yet.

Other frequent mistakes:

• Using the browser that does not hold the key. Delegations, cancellations and approvals are signed in the browser with keys stored in that browser, and each account uses only its own keys there: its personal keys, and the principals it generated or imported. On another browser or device, or in a browser profile where another account stored the key, import your key backup from your account page first.
• Expecting a test key to be a sandbox. A kb_test_… key calls the same Gateway, policies and upstream tools as a kb_live_… key. Its environment (test or live) is recorded with every call and decides which observe windows apply; it does not send calls anywhere else.
• Mixing management keys and gateway keys. Management keys call the Cloud API and are refused by the Gateway (401). Gateway keys call the Gateway and are refused by the Cloud API.

For the full walkthrough, see Setup guide and Your first protected action.

Refused by your role (403)

Every member has one role: owner, admin, approver, developer or viewer. The Cloud API reads your role again on every request, so a role change takes effect at once. The dashboard hides controls your role cannot use, but it takes your role from the session it loaded: after a role change, reload the page.

The role summary:

See Roles and permissions for the complete matrix and API keys for key scopes.

Next steps