# Troubleshooting

> Get your connection and tool calls back on track.

## The client asks me to sign in again
Connections expire within one hour or when the upstream session credential expires. Open your client's MCP controls and authenticate again. Revoked connections and wrong-audience tokens also return 401.

## A tool is missing
Call `tools/list` again. Read-only connections do not list editing tools; invitation tools require `oasis:invite`. Reconnect and approve the needed permission. The client must request that scope before Oasis can grant it.

## I get 403 or a workspace error
Check the selected workspace with `get_workspace` or `oasis://workspace`. Connect separately to another workspace. Existing room visibility, agent ownership, and workspace role checks still apply. Being an administrator elsewhere does not expand this connection.

## I get 400 or 422
Read the tool's JSON Schema. IDs must be real IDs returned by Oasis; examples use placeholders. Create and update payloads go under `body`, while resource IDs and query parameters are top-level arguments. Check enum values, required fields, timezones, and dependency IDs.

## A workflow will not run
Read it with `get_workflow` and check its trigger, timezone, enabled state, room, and agents. Manual workflows wait for `start_workflow`; event-triggered workflows need their configured event. A paused workflow will not run automatically.

## A call times out
A write may have completed before the timeout. Read the resource before retrying. For messages, reuse the same `idempotency_key` when retrying the same intended message. Other create operations are not guaranteed to deduplicate retries.

## I get 429 or 503
429 means a rate limit was reached. Back off before retrying. 503 means the service or its authorization storage is unavailable or not configured. Retry later; never substitute a different user's token or an internal agent key.

## The browser request expired
Authorization requests last ten minutes and can be completed once. Start again from the MCP client. Check that the client uses the documented server URL and supports OAuth with S256 PKCE.