Help Tutorials
Find out why someone can't get into an app
Someone says "I can't open Invoicer". Work through these in order. You need users.list and entitlements.manage, or to own the app.
1. Is their account active?
Open them in Users. If they're Suspended, nothing works until they're reactivated. If they're Invited, they haven't accepted the invitation yet, so resend it.
2. Do they have an active path to the app?
On the Access tab, find the app. Its status tells you most of the answer:
| Status | Means | What to do |
|---|---|---|
| Active | They have access | Go to step 4 |
| Scheduled | Access starts later | Check the start date |
| Turned off | Someone paused it | The reason is shown. Turn it back on if that's right. |
| Expired | A trial or term ended | Extend the end date, or grant access again |
| Revoked | The purchase was removed | Grant new access. A revoked grant can't be reinstated. |
| No access | Nothing grants it | Grant it, or check their plan if it's a standard app |
3. Is an organization leaving them out?
If their access comes from an organization, the path shows whether that organization's grant includes them. They're left out if the grant uses:
- an allowlist that doesn't name them, or
- a denylist that does.
That's the organization's decision, and one of its org admins can change it.
4. Do they have the right role in the app?
Open Why?. It shows their effective permissions in the app, live from the API. If they can get in but can't do one particular thing, they're missing the role that grants it. Assign it on the Roles tab.
5. Is the app itself suspended?
If the Application is suspended, nobody can get new app tokens for it. Check Developer → Applications.
Screens in this tutorial
USR-03 · User — Overview ACX-01 · User — Access ACX-04 · Access check (Why?)