# Connection and authentication errors

> The exact messages a failed connection test or a rejected credential produces, and what each one means.

Search this page for the words you saw. Connector tests and credential
rejections produce different messages, so they are listed separately.

## A connection test came back Failing

**Test Connection** returns a badge and a message, plus **Last tested**,
**Latency**, and an **HTTP** status where one applies.

| Message | Means | Fix |
|---|---|---|
| *no base URL configured* | The HTTP connector has no **Base URL**. | Add it, including the scheme. |
| *HTTP 401. Authentication rejected.* | The endpoint answered, and refused the credential. | Check the token or key, and the **Authentication Type**. |
| *Access denied. Check credentials.* | The service rejected the identity outright. | Usually an S3 access key without permission on the bucket. |
| *bucket 'x' not found* | The bucket name or region is wrong. | Check both; a bucket in another region reads as missing. |
| *missing required Snowflake fields* | Account identifier, warehouse, database, username, or private key is blank. | Fill the blanks and save. |
| *save the connector first, then run Test Connection* | Snowflake connectors must exist before they can be dialled. | Save, then test from the connector's page. |

**Unverified** is not an error. It means the connector has never been tested
and has not failed.

An inbound connector has no test button — nothing is there for Hodoflow to
dial. Its status comes from real traffic instead. See [Inbound
connectors](/help/credentials-connections/inbound-connectors).

## An inbound connector flipped to Failing on its own

Five authentication failures inside one minute flips an inbound connector to
**Failing**; one success flips it back to **Verified**.

Something is presenting the wrong key. Check what the sender is sending before
regenerating anything — regenerating while a sender is misconfigured just
changes which wrong key it is using.

## A service account will not authenticate

Every credential problem at the token exchange returns the same response:

```json
{"error": "invalid_client"}
```

with status `401`. Missing credentials, a wrong secret, an unknown client, and
a deactivated service account all look identical from the outside. That is
deliberate — it tells an attacker nothing.

Check, in this order:

1. Is the service account **Active**? A deactivated one authenticates as
   nothing.
2. Are you sending the *current* pair? A **Promote staged** invalidates the
   previous pair immediately.
3. Is the client ID the one beginning `cid_` and the secret the one beginning
   `csec_`, not swapped?
4. Are you exchanging against `/api/v1/oauth/token` and sending the result as
   `Authorization: Bearer <access_token>`?

## A request into Hodoflow was rejected

| Status | Means | Fix |
|---|---|---|
| `401` | The access token is missing, expired, or was issued from a deactivated service account. | Exchange again. Tokens last 15 minutes. |
| `403` | Authenticated, but the token does not carry the scope the request needs. | Add the scope, then exchange again — a scope change takes effect on the next exchange. |
| `404` | No active trigger matches the token. | Activate the workflow; only active triggers are served. |
| `413` | The body is over 1 MB. | Send less, or split the payload. |
| `422` | The payload could not be processed. | Check it is valid JSON of the shape the workflow expects. |
| `429` | Over 100 requests per minute for this trigger token. | Back off using the `Retry-After` header. |

## A step failed at run time with an authentication error

The step's **Error** column in Monitor holds what the external service said.

- A `401` from a step with a connector selected means the connector's stored
  credential is wrong or expired. Test the connector — that dials with the
  stored credential, unlike **Test Request**.
- A `401` from **Test Request** alone means nothing about the real run.
  **Test Request** does not apply the connector's credentials.
- A `403` usually means the credential is valid but lacks permission for that
  operation at the provider. Nothing in Hodoflow can widen it.

## Common problems

**Test Connection passes but the run fails.** They are not the same call. The
test dials the connector's base configuration; the run calls a specific path
with a specific method. Check the step's URL and the operation's permissions.

**Test Request fails but the run succeeds.** Expected when a connector is
selected — see above.

**A stored secret cannot be read back to check it.** Correct: secrets are
encrypted and never returned to the browser. Re-enter it rather than trying to
confirm it.

**Everything failed at once after an edit.** A secret field you meant to leave
blank was typed into, replacing the stored value. Re-enter the correct
credential.

## Related

- [Naming, reuse, rotation, and deletion](/help/credentials-connections/lifecycle)
- [Activation errors](/help/workflows/activation-errors) for a workflow that
  will not go live, which is a different problem.