Hodoflow / Help Center
Sign in
Browse documentation
Developers →
Troubleshooting Updated 11 August 2026

Connection and authentication errors

The exact messages a failed connection test or a rejected credential produces, and what each one means.

View as Markdown

Search this page for the words you saw. Connector tests and credential rejections produce different messages, so they are listed separately.

A connection test came back Failing

Test Connection returns a badge and a message, plus Last tested, Latency, and an HTTP status where one applies.

Message Means Fix
no base URL configured The HTTP connector has no Base URL. Add it, including the scheme.
HTTP 401. Authentication rejected. The endpoint answered, and refused the credential. Check the token or key, and the Authentication Type.
Access denied. Check credentials. The service rejected the identity outright. Usually an S3 access key without permission on the bucket.
bucket 'x' not found The bucket name or region is wrong. Check both; a bucket in another region reads as missing.
missing required Snowflake fields Account identifier, warehouse, database, username, or private key is blank. Fill the blanks and save.
save the connector first, then run Test Connection Snowflake connectors must exist before they can be dialled. Save, then test from the connector's page.

Unverified is not an error. It means the connector has never been tested and has not failed.

An inbound connector has no test button — nothing is there for Hodoflow to dial. Its status comes from real traffic instead. See Inbound connectors.

An inbound connector flipped to Failing on its own

Five authentication failures inside one minute flips an inbound connector to Failing; one success flips it back to Verified.

Something is presenting the wrong key. Check what the sender is sending before regenerating anything — regenerating while a sender is misconfigured just changes which wrong key it is using.

A service account will not authenticate

Every credential problem at the token exchange returns the same response:

{"error": "invalid_client"}

with status 401. Missing credentials, a wrong secret, an unknown client, and a deactivated service account all look identical from the outside. That is deliberate — it tells an attacker nothing.

Check, in this order:

  1. Is the service account Active? A deactivated one authenticates as nothing.
  2. Are you sending the current pair? A Promote staged invalidates the previous pair immediately.
  3. Is the client ID the one beginning cid_ and the secret the one beginning csec_, not swapped?
  4. Are you exchanging against /api/v1/oauth/token and sending the result as Authorization: Bearer <access_token>?

A request into Hodoflow was rejected

Status Means Fix
401 The access token is missing, expired, or was issued from a deactivated service account. Exchange again. Tokens last 15 minutes.
403 Authenticated, but the token does not carry the scope the request needs. Add the scope, then exchange again — a scope change takes effect on the next exchange.
404 No active trigger matches the token. Activate the workflow; only active triggers are served.
413 The body is over 1 MB. Send less, or split the payload.
422 The payload could not be processed. Check it is valid JSON of the shape the workflow expects.
429 Over 100 requests per minute for this trigger token. Back off using the Retry-After header.

A step failed at run time with an authentication error

The step's Error column in Monitor holds what the external service said.

  • A 401 from a step with a connector selected means the connector's stored credential is wrong or expired. Test the connector — that dials with the stored credential, unlike Test Request.
  • A 401 from Test Request alone means nothing about the real run. Test Request does not apply the connector's credentials.
  • A 403 usually means the credential is valid but lacks permission for that operation at the provider. Nothing in Hodoflow can widen it.

Common problems

Test Connection passes but the run fails. They are not the same call. The test dials the connector's base configuration; the run calls a specific path with a specific method. Check the step's URL and the operation's permissions.

Test Request fails but the run succeeds. Expected when a connector is selected — see above.

A stored secret cannot be read back to check it. Correct: secrets are encrypted and never returned to the browser. Re-enter it rather than trying to confirm it.

Everything failed at once after an edit. A secret field you meant to leave blank was typed into, replacing the stored value. Re-enter the correct credential.

Related documentation