# Troubleshooting

The embed won’t show, won’t sign in, or stops. Find what you see below.

Start with your page’s browser console. The SDK names what went wrong there, and `mount()` rejects with an `EmbedError` whose `code` says why.

- [not_allowed_here, “This can’t be shown here.”, or the frame refused by frame-ancestors](https://docs.gorunner.io/embed/troubleshooting#not-allowed-here): It doesn’t show
- [timeout](https://docs.gorunner.io/embed/troubleshooting#timeout): It doesn’t show
- [licence or unavailable, “Workflows are unavailable right now.”](https://docs.gorunner.io/embed/troubleshooting#licence): It doesn’t show
- [A thin strip, or nothing at all](https://docs.gorunner.io/embed/troubleshooting#thin-strip): It doesn’t show
- [version_mismatch](https://docs.gorunner.io/embed/troubleshooting#version-mismatch): It doesn’t show
- [code_failed, “Couldn’t sign you in.”](https://docs.gorunner.io/embed/troubleshooting#code-failed): It doesn’t sign in
- [code_expired](https://docs.gorunner.io/embed/troubleshooting#code-expired): It doesn’t sign in
- [access_ended, “Your access ended”](https://docs.gorunner.io/embed/troubleshooting#access-ended): It doesn’t sign in
- [“Couldn’t reconnect.”, session_failed](https://docs.gorunner.io/embed/troubleshooting#couldnt-reconnect): It stops later
- [“Workflows are paused.”, or everyone stops at once](https://docs.gorunner.io/embed/troubleshooting#paused): It stops later
- [“That isn’t available here.”, “This page isn’t available here.”, not_available](https://docs.gorunner.io/embed/troubleshooting#not-available): It stops later
- [A connection won’t sign in, or shows Expired](https://docs.gorunner.io/embed/troubleshooting#connections): Connections
- [A font or color isn’t what you set](https://docs.gorunner.io/embed/troubleshooting#look): The look

## `not_allowed_here`

**Why**

Your page’s website isn’t on the allowed websites. Customers see “This can’t be shown here.” The browser says the same when it refuses the frame by `frame-ancestors`.

**Fix**

1. Compare your page’s address with **Platform › Partner keys › Allowed websites**. The scheme, host and port must all match: `https://www.app.example.com` isn’t `https://app.example.com`.
2. A wildcard `https://*.example.com` never covers `https://example.com` itself, and plain `http` works only for `localhost`.
3. A page opened from a file has no website at all: serve it over http.
4. On a website your server added for one customer, check the account your route asks a code for. Another account’s code is refused there.

A change applies to the next page load.

## `timeout`

**Why**

The frame never answered. Most often, your page’s Content-Security-Policy blocks the installation.

**Fix**

1. Allow the installation in `frame-src`, `script-src` (for `/embed.js`) and `connect-src`.
2. Behind your own proxy, check that it passes `/embed/` through and adds no `X-Frame-Options` or `Content-Security-Policy` of its own. See [Behind your own proxy](https://docs.gorunner.io/self-host/own-proxy).

## `licence` or `unavailable`

**Why**

`licence`: the license doesn’t include Embed, or [it ended and the installation is paused](https://docs.gorunner.io/self-host/license-ends). Customers see “Workflows are unavailable right now.”, and their work is kept. `unavailable`: the installation’s sign-in is off, or every page is switched off for this person. Customers see “This isn’t available right now.”

**Fix**

1. Check what the license includes on **Platform › Settings › General**.
2. Check that the operator hasn’t turned sign-in off: [`AUTH_ENABLED`](https://docs.gorunner.io/self-host/settings#AUTH_ENABLED) must be `true`.
3. Check the switches at all [three levels](https://docs.gorunner.io/embed/switches#three-levels).

## A thin strip, or nothing at all

**Why**

The element has no height of its own, so the SDK gives the frame 640 px and says so in the console. Or your page is on https and the installation on http, which browsers refuse.

**Fix**

1. Give the element a height.
2. Serve the installation over https.

## `version_mismatch`

**Why**

Your SDK and the installation share no protocol version, such as a copy of the SDK from another major version.

**Fix**

1. Load `/embed.js` from the installation: it always matches. See [Versions and upgrades](https://docs.gorunner.io/embed/versions).

## `code_failed`

**Why**

Your `getCode` threw, timed out, or returned something that isn’t a code. The message carries your error. Customers see “Couldn’t sign you in.”, with **Try again**.

**Fix**

1. Call your login-code route by hand and read its answer.
2. Read your server’s log for what the installation answered:

- 401 `UNAUTHORIZED`

  The key is missing, mistyped or revoked, or a rotated key past its grace time.

- 403 `IP_NOT_ALLOWED`

  The key’s **Allowed from** doesn’t include your server’s address, as the installation sees it.

- 403 `EMBED_NOT_LICENSED`

  The license doesn’t include Embed, or the installation is paused.

- 400 `VALIDATION_ERROR`

  A field is wrong; `details.field` names it.

- 409 `ACCOUNT_DELETED`

  The account is deleted. Restore it first.

- 403 `ORG_LIMIT`

  A new account would pass the license’s organization limit. `WORKSPACE_LIMIT` is the same for workspaces.

- 429 `RATE_LIMITED`

  Too many this minute. Wait `Retry-After` seconds. `X-RateLimit-Scope: person` is one person’s 20 codes a minute, often a page reloading in a loop.

## `code_expired`

**Why**

The installation refused the code twice: it was used already, or it was over 60 seconds old.

**Fix**

1. Make sure your route makes a new code on every call, and nothing caches its answer.

## `access_ended`

**Why**

The person no longer has access, and sees “Your access ended”: they were removed, the account or workspace was deleted, or your server took the page’s website off the account’s list.

**Fix**

1. To put them back, give them a new code for the account, and add the website again if that was it.

## “Couldn’t reconnect.”

**Why**

The frame renews its session for up to 12 hours, then calls your `getCode` again. That call failed (`session_failed`), often because your own app’s session had ended and your route refused. The customer’s changes are kept, with **Try again**.

**Fix**

1. Keep your app’s session longer than the embed’s.
2. Or, when your route refuses, send the person to sign in to your app.

## “Workflows are paused.”, or everyone stops at once

**Why**

The account is suspended: everything is read-only, and your page heard an `error` with `account_suspended`. People stay signed in, and **Contact support** goes to Branding’s Support link. If everyone fails at once, a key your server still uses was revoked, so `getCode` fails, or the account was deleted (`access_ended`).

**Fix**

1. Resume the account from your server or its record. See [Suspend an account](https://docs.gorunner.io/embed/usage-suspension-deletion#suspend).
2. After a revoked key, people sign in again once your server uses another key.

## “That isn’t available here.”

**Why**

A switch is off at one of the three levels, or the role doesn’t allow it, and something behind it was reached anyway, such as through an old link. The server answered `403 FEATURE_OFF` with the switch in `details.switch`. A whole page switched off reads “This page isn’t available here.” (`not_available`): a key takes the person to the first page that is on, and unsaved changes in the builder are kept until it is back.

**Fix**

1. Find the switch, then turn it on where it was turned off: **What customers get**, the account’s `turnOff`, or the sign-in’s.

## A connection won’t sign in, or shows Expired

**Why**

The sign-in window can’t open from inside a sandbox, or the provider has no OAuth app here (`not_configured`), or the provider stopped accepting the connection.

**Fix**

1. If your page is in a sandboxed frame, give it `allow-popups` and `allow-popups-to-escape-sandbox`.
2. Add the provider’s app on **Platform › OAuth apps**.
3. For Expired, the customer signs in again. It happens after the person revoked access, or the OAuth app that signed it in changed.

## A font or color isn’t what you set

**Why**

A font didn’t load, or a color was moved so text stays readable. A [flag](https://docs.gorunner.io/embed/appearance#flags) says which.

**Fix**

1. A font your page proposes must be a WOFF2 or WOFF file on the page’s own website; one in Branding must be uploaded or on an allowed website (`font_origin_not_allowed`).
2. A font service’s stylesheet is never loaded: upload the font’s files instead.
3. A font that takes over 1.5 seconds gives way to the fallback for that page load (`font_unavailable`).

## Still stuck?

Write to [GoRunner support](https://gorunner.io/contact). Send the code from the console, your page’s address, the time, and what your login-code route answered.

Source: https://docs.gorunner.io/embed/troubleshooting