Supporting a client who cannot connect

Work through this in order. Most cases are solved by step 2 or 3.

1. Get the facts

Ask for:

Which app: claude.ai, Claude Desktop, Claude Code or Codex.
The email they signed in with.
The exact message, and any brief ID or request ID the app showed.
Whether they use the plugin or added the connector by hand.

If the app is anything else, such as ChatGPT, it is not supported. Stop there.

2. Check the person in the Command Centre

Open Users and find them.

Not listed, or a different email: they get account_not_found. Invite them with the email they actually use (see Inviting contacts), then have them connect again.
Login migration shows Linked: the account is linked. The problem is in the app or the request.
Not migrated: they have not completed a first call yet. Sign-in itself may be failing (step 3).
AI disconnected: someone clicked Disconnect. See Revoking and resetting AI access.
Revoked · identity reserved or Issuer review required: escalate to an admin.

The most common fault is signing in with a password or Google. That gives identity_untrusted or identity_conflict. Ask them to start a fresh sign-in from the app, enter their HockeyStick email and use the email code.

Other sign-in symptoms:

Symptom	Fix
"Oops, something went wrong" after the email	Start a fresh sign-in from the app. A sign-in started before a setup change keeps the old settings.
"Callback URL mismatch" or the browser never returns	Port busy or not set: Codex needs 6279 free and `mcp_oauth_callback_port = 6279`; Claude Code needs 6278. Codex users must keep `--oauth-client-id`.
Connector shows connected but every call fails	Disconnect and Connect again in the app for a fresh sign-in.
Claude Team or Enterprise user cannot add a connector	Their Claude administrator must add it under Organization settings > Connectors.

4. Check what they are asking for

Symptom	Cause
`ACTIVATE_REQUIRED`	The client has no Activate allocation.
"Staff permission required"	They asked for go-live, readiness or Riley publishing.
`insufficient_scope`	Signed in read-only. Reconnect with write access.
`CLIENT_WRITE_REQUIRED`	You, as staff, tried to log revenue. The client must do it.
App does not know a new tool	Old tool list. Reconnect and start a new chat; in Claude Code toggle the server in `/mcp` and start a new session.
They want to edit partner figures	Not possible. PartnerStack figures are read-only everywhere.

5. Check the app is using the right address

Make sure they are connecting to the environment you expect. The plugin and the client guide use the Test address. Do not give out a production address until engineering confirms it.

6. Escalate

Escalate to engineering with the email, app, time, exact message and request IDs for: auth_unavailable, exchange_unavailable, admission_unavailable, identity_conflict you cannot explain, a write with an uncertain outcome, or an admitted app that Auth0 refuses.