Troubleshooting
Use this page to diagnose the most common integration failures before escalating to support.
Username and/or Password Incorrect
Symptom: Managed API requests fail with an authentication error.
Likely cause: The Cognito username or password is invalid, expired, or out of sync with the expected environment.
How to fix: Confirm the service account credentials, verify the environment, and rotate credentials if needed.
Wrong base URL
Symptom: Requests fail unexpectedly or the auth model seems wrong.
Likely cause: A Direct API flow is pointed at the Managed API host, or a Managed API flow is pointed at the Direct API host.
How to fix: Use https://api.crittoraapis.com for Direct API and https://managed.crittoraapis.com/v1 for Managed API.
Expired bearer token
Symptom: Direct API requests start failing after initial success.
Likely cause: The token used in Authorization headers is no longer valid.
How to fix: Refresh or reissue the token on the server side and retry the request with a current bearer token.
Invalid API key, access key, or secret key
Symptom: Requests are rejected even though the username and password are correct.
Likely cause: Partner credentials are missing, incorrect, or rotated without updating the application.
How to fix: Confirm stored partner credentials and update your secret store with the current values.
CAAB Partner not found during app-client creation
Symptom: Crittora Secure app-client provisioning reports Partner not found.
Likely cause: The submitted identifier is not a partner in the selected Crittora Secure environment, or a CAAB logical partner ID was used as a Secure partner ID.
How to fix: Create or locate the partner through the supported Crittora Secure provisioning service and pass its Secure partner ID. Do not write partner records directly to Crittora tables.
CAAB service identity username already exists
Symptom: Provisioning returns UsernameExistsException or a generic credential-provisioning error.
Likely cause: The requested app-client email or username is already registered.
How to fix: Use a unique service identity email or name and inspect the provisioning Lambda logs for the underlying error.
CAAB Managed API endpoint returns 404
Symptom: Policy-crypto calls to a /v1/sign-encrypt path return 404.
Likely cause: The CAAB policy-crypto client was given a base URL containing /v1.
How to fix: Use https://managed.crittoraapis.com as the base URL. The client appends /sign-encrypt and /decrypt-verify.
Replacement cannot decrypt an existing v2 policy
Symptom: A new CAAB SEDV app client cannot decrypt ciphertext written by the primary identity.
Likely cause: The clients may belong to different Crittora Secure partners, lack s/e/d/v, or CAAB may be reading the wrong secret version.
How to fix: Confirm same-partner ownership, exact permissions, and the deployed secret reference. Keep the primary credential active until continuity checks pass.
CAAB user assertion rejected
Symptom: A headless governed invocation rejects X-CAAB-User-Assertion.
Likely cause: The token may be an ID token, have the wrong issuer or audience, be expired, or omit the configured tenant/group value.
How to fix: Send a short-lived access token and verify issuer, audience/client ID, exp, iat, token_use=access, immutable subject, and the configured tenant claim.
CAAB cross-binding request denied
Symptom: A valid workload token is rejected when used with another binding in the route.
Likely cause: The route binding does not match the workload client's server-side mapping.
How to fix: This is expected fail-closed behavior. Obtain a workload client scoped to the target binding.
CAAB MCP connects but no runtime tools appear
Symptom: The client completes OAuth but tool discovery returns no imported tools.
Likely cause: The user may be suspended, lack an active boundary, have an expired or revoked policy, or have no matching permitted operations.
How to fix: Confirm tenant membership, role, boundary status, policy lifetime, and the selected permission IDs. Reconnect after the boundary is updated.
Remote MCP tool fails with catalog drift
Symptom: A previously available remote MCP tool is denied after the downstream server changes.
Likely cause: The current endpoint, protocol, transport, catalog version, or tool contract no longer matches the immutable catalog and signed policy snapshot.
How to fix: Review and register the revised catalog, update the affected boundary, and let CAAB recompile the policy. Do not bypass the drift check.
Check these first
- Are you on Direct API or Managed API?
- Are you using the correct base URL?
- Are the credentials current for that environment?