Login Troubleshooting

Session expired

The platform uses Clerk for authentication. Clerk keeps a long-lived session for your browser and issues short-lived session tokens from it, refreshing them in the background while the tab is open. When the session itself ends, you have to sign in again.

Symptoms of an expired session:

• You are redirected to the login page unexpectedly.
• API calls return 401 Unauthorized.
• Pages that were already open stop updating.

What to do:

1. Sign out completely using the profile menu.
2. Clear cookies for ivybiosciences.com, accounts.ivybiosciences.com and clerk.ivybiosciences.com.
3. Sign in again. Session expiry doesn't affect your data or running jobs.

If you're signed out again within minutes, check that your system clock is accurate. Session tokens are short-lived, so a skewed clock makes them look expired. See Time skew.

SSO and OAuth failures

You can sign in with Google, GitHub or LinkedIn, or with an email address, phone number or username. Each identity provider has its own failure modes.

Google:

• "Access blocked" error: your Google Workspace admin may have restricted third-party app access. Ask your IT admin to allow the platform as a trusted application.
• Pop-up or redirect blocked: allow pop-ups and redirects for accounts.google.com.
• Account chooser loops: if you have several Google accounts, the chooser may loop. Sign out of all Google accounts, then sign in with only the one you want to use.
• "Redirect URI mismatch": this is a server-side configuration issue. Contact support.

GitHub:

• "Application not authorized" error: grant the platform access to your GitHub account. If you denied access before, go to GitHub Settings then Applications then Authorized OAuth Apps to revoke and re-authorize.
• Organization restrictions: if your GitHub account belongs to an organization that enforces SSO, you may need to authorize the platform through your org's SSO page first.
• Two-factor authentication: complete the GitHub 2FA challenge if prompted. Accounts with 2FA work normally.
• Email privacy: if your GitHub email is private, Clerk may not be able to match it to your existing account. Use the same email in both places, or sign in with a different method.

LinkedIn:

• Consent screen closes without signing you in: sign in to LinkedIn in the same browser first, then retry.
• Email mismatch: LinkedIn shares your primary email. If it differs from the email on your platform account, Clerk treats it as a different user.

General SSO fixes:

1. Try a different browser or an incognito window.
2. Clear cookies for both ivybiosciences.com and the identity provider's domain.
3. Check that the email on your identity provider matches your platform account email.
4. Disable browser extensions that modify network requests (ad blockers, privacy extensions).
5. Allow cookies for the identity provider's domain.

Email verification pending

New accounts must verify their email address before they get full access.

• Check your spam folder. Verification emails sometimes land in spam or promotions tabs.
• Resend the verification. Request a new code or link from the sign-up screen.
• Check the email address. Make sure you're checking the address you signed up with. Clerk sends verification only to that address.
• Corporate email filters. Some corporate mail servers block or delay automated email. Ask your IT team to allowlist ivybiosciences.com and clerk.com.
• Subaddressing. Addresses with + tags (for example [email protected]) work, but some corporate mail servers strip or reject them.

If you still haven't received the email after 10 minutes and several resends, contact support with your email address and approximate sign-up time.

Account locked or rate limited

The platform rate-limits authentication to prevent abuse.

• Too many failed attempts. After 5 failed sign-in attempts, Clerk locks the account for 60 minutes. Wait and try again, or reset your password.
• IP-based rate limiting. If many authentication requests come from one IP address (common in corporate offices behind NAT), that IP may be blocked temporarily. Try from a different network or contact support.
• Repeated resends. Requesting many verification or password-reset emails in a row triggers a cooldown. Wait a few minutes before you try again.

How to tell if you are rate limited: the login form says you've made too many attempts. The API returns HTTP 429 with a Retry-After header that tells you when you can retry.

Multi-device sessions

You can be signed in on several devices at once, and every device sees the same account data. Each browser holds one signed-in account at a time.

• Revoking sessions. Go to Profile settings, open the Security section, and sign out any device you don't recognize.
• Session visibility. The same section lists your active devices. If you see one you don't recognize, sign it out and change your password.
• CLI devices. A signed-in CLI is a separate device. List CLI devices with ivybloom auth devices list, and revoke one with ivybloom auth devices revoke DEVICE_ID.

API key authentication

API keys give scripts and the CLI programmatic access to the platform API without signing in through a browser.

Creating an API key:

1. Go to Profile settings → API keys.
2. Create a new key.
3. Give it a descriptive name (for example "CI pipeline" or "notebook access").
4. Optionally set an expiry. A key without an expiry lasts until you revoke it.
5. Copy the key immediately. The platform stores only a hash of the key, so it can't show the key again.

Common API key issues:

• "Invalid API key" error. Send the key in the Authorization header as Bearer ivy_<keyId>_<secret>, with no quotes or extra whitespace.
• Key expired. Check the key's expiry on the API keys page. An expired key returns 401.
• Key revoked. A revoked key stops working immediately. Create a new one.
• Wrong environment. Keys created on the hosted platform don't work on a self-hosted instance, and vice versa.
• Key permissions. A key acts as the user who created it, within the scopes set on the key.

Rotating keys:

1. Create a new key before revoking the old one.
2. Update everything that uses the old key (scripts, CI pipelines, notebooks).
3. Confirm the new key works in each of them.
4. Revoke the old key.
5. Never commit API keys to version control. Keep them in environment variables instead.

Guest access

Some things work without an account.

What works without signing in:

• Viewing results shared by public link (/share/[token])
• Reading the documentation
• Starting a guest chat, with limited tools and quota. See Guest sandbox.

What requires an account:

• Saved projects, campaigns and chat history
• Creating API keys and using the authenticated API
• Billing and account management

If a shared link asks you to sign in, the owner may have revoked the link. Ask the person who shared it.

Password and account recovery

If you signed up with an email and password (not SSO):

• Forgot password. On the login page, choose "Forgot password?" and enter your email. Clerk emails you a reset code.
• Account deletion. In Profile settings, the privacy and data section links to the data-request form. Deletion removes your account, projects and job history, and it can't be undone.
• Email change. Add the new address in Profile settings, verify it, then make it your primary address.

Browser-specific login issues

Some login problems are specific to certain browsers.

• Safari ITP (Intelligent Tracking Prevention). Safari may block Clerk authentication cookies as cross-site tracking. In Safari Settings then Privacy, turn off "Prevent cross-site tracking" temporarily to test.
• Firefox Enhanced Tracking Protection. Strict mode may block authentication redirects. Click the shield icon in the address bar and turn off Enhanced Tracking Protection for ivybiosciences.com.
• Chrome third-party cookie restrictions. The platform's Clerk integration uses first-party cookies on ivybiosciences.com subdomains. On a self-hosted custom domain, make sure Clerk is configured for that domain.
• Brave shields. Brave's default shields block third-party cookies and fingerprinting, both of which can interfere with authentication. Lower the shields for ivybiosciences.com.

Self-hosted authentication

If you run a self-hosted instance, authentication is configured separately from the hosted platform.

• Clerk keys. A self-hosted instance needs its own Clerk publishable key and secret key. The hosted platform's keys don't work.
• Redirect URLs. Configure your Clerk application with redirect URLs that match your self-hosted domain.
• HTTPS required. Clerk requires HTTPS in production. Self-signed certificates may cause issues, so use a certificate from Let's Encrypt or your organization's CA.

If you are still blocked

If none of the above resolves your login issue:

1. Capture a screenshot of the error, including the full URL in the address bar.
2. Note the approximate time and your timezone.
3. Record which sign-in method you used (email, phone, username, Google, GitHub or LinkedIn).
4. Check whether you can reach www.ivybiosciences.com at all (DNS resolution).
5. Try from a different device and network to isolate the issue.
6. Submit a ticket via Support with all of the above details.