Web application firewallZero Trust
Access troubleshooting
Resolve sign-in, policy, and origin-verification errors.
| Problem | What to check |
|---|---|
| Setup error when saving | Check verified HTTPS for every direct origin. Contact support if the message reports a service requirement. |
| Provider callback error | Register the exact callback shown for the application hostname. |
| Email code does not arrive | Check Access activity for policy denial, rate limits, and delivery errors. |
| Sign-in succeeds but access is denied | Check assigned providers, verified email, and matching deny policies. |
| Origin rejects the assertion | Check issuer, audience, signature, clock, method, hostname, and final URI. |
| Save reports a configuration conflict | Reload the configuration and apply your changes again. |
| New policy has no effect | Allow the update to apply, then test a new request. Existing WebSockets keep their original decision. |
Request status
An unauthenticated browser navigation opens the sign-in page. Other unauthenticated requests receive HTTP 401 with a login URL. A signed-in identity rejected by policy receives HTTP 403.
Further checks
Use the request ID to find related access events. Include it when contacting support.
For custom identity services, check the provider requirements.