Skip to main content

Login and Accounts

Sign-in loops, session-expired alerts, missing accounts, and the recent fix to the logout flow.

Pilot
Agronomist
Farmer

Most authentication issues fall into three buckets: sign-in fails, session expires unexpectedly, or the right account isn't visible. This page covers each.

Sign-in fails

"Invalid username or password"

The credentials don't match. Check:

  • Email is the address you were invited under (the one in your invitation email).
  • Password matches what you set after the first sign-in. If you forgot, use the Forgot password link on the sign-in page.

If you set the password and it still doesn't work, ask your account owner to reset it from Settings → Users & Permissions.

Redirect loop with the identity provider

The portal authenticates against Keycloak. If you get bounced back and forth between the portal and the identity provider:

  1. Clear cookies for both domains and try again.
  2. Try a private/incognito window to rule out browser-extension interference.
  3. If the loop persists in incognito, open a ticket — the issue is server-side.

Session expired unexpectedly

Single "Session expired" alert after idle period

Expected. The portal expires sessions after the configured idle period for security. Sign back in.

Repeated "Session expired" alerts

The portal had a bug (fixed in PR #208) where an idle session would produce a logout loop with multiple session-expired prompts. The fix:

  • Adds a GET /api/auth/logout Route Handler that clears the NextAuth session and redirects to Keycloak via top-level navigation.
  • Updates the expired-session handling so the alert fires once, not repeatedly.
  • Sends Keycloak's id_token_hint to skip the logout confirmation page.

If you're still seeing repeated alerts:

  1. Hard reload (Ctrl+Shift+R / Cmd+Shift+R) to pick up the latest portal version.
  2. Sign out fully via the avatar menu → Logout.
  3. Clear cookies for the portal domain.
  4. Sign back in.

If repeated alerts continue after a hard reload and full logout, open a support ticket.

"Authentication required" alerts in the middle of a workflow

The session token expired mid-workflow. Causes:

  • You were idle for too long.
  • Your access token rotated; the refresh failed (rare).
  • You signed in on a second tab; the first tab's session was invalidated.

Sign back in. The portal will return you to the page you were on.

Wrong / missing accounts

"No Accounts Found — Redirecting to onboarding"

Your user exists but isn't tied to any account.

  • If you were just invited and this is your first sign-in, your account owner needs to confirm the invitation went through (sometimes the role wasn't saved correctly).
  • If you previously had access and lost it, you may have been removed from the account. Contact the owner.

"Account Not Found — Redirecting to default account"

You clicked a deep link to an account you no longer have access to. The portal silently redirects to whichever account you do have access to.

Account Switcher shows fewer accounts than expected

The switcher only shows accounts your user is currently active in. If you've been suspended on one account but not others, that account is hidden until reinstated.

To get reinstated, contact the owner of that account.

Avatar won't upload

The avatar upload (PR #207) uses S3 presigned URLs. Common failure modes:

  • File > 5 MB — the cap. Resize before uploading.
  • Wrong file type — must be JPG or PNG.
  • Network issue mid-upload — retry.

"Edit Account" button is missing

The button is Owner-only. If you're an Administrator, Member, Pilot, or any other role, you'll see the Account card read-only. Ask the owner to make the edit.

Permissions errors

"Access denied" on a feature you expect to have

The error means your role doesn't have permission for the action. Common cases:

  • Members can't manage other users — that requires Administrator or Owner.
  • Technicians can't create prescriptions — they have read-only access on most features.
  • Pilots can't manage their own flight authority — only the owner / admin can grant.

If the role is wrong, ask the owner to update it.

Was this page helpful?

Edit this page on GitHub

Last updated Oct 20, 2018