When someone cannot sign in

The common cases, in the order they actually occur.

"This account can't open the admin console"

The identity is valid but has no admin record. Nearly always passkey autofill picked the wrong saved account — someone with both a personal and a work identity on the same machine. Sign out, sign in again, and choose deliberately.

The other possibility is that they are a developer, not an admin. Developers do not use the console.

The invite link does not work

Invites are single-use and they expire. Users & Teams → Pending & past invites shows the status: pending, accepted, expired or revoked. Resend issues a fresh link and invalidates the old one.

They lost the device with their passkey

Resend passkey on their row in the admin table. They get a new setup link and can register a passkey on a new device. Their old passkey stays registered until they remove it — worth cleaning up if the device is genuinely gone rather than merely replaced.

SSO worked yesterday and does not today

Check Organization SSO: the status badge shows Failing when validation against your provider stops succeeding. The usual cause is an expired client secret. Edit the configuration, put in the new secret, re-run the test login.

Nobody can get in at all

If every admin has lost access, open a ticket from any other channel you have with us. This is exactly why the console asks you to have a second admin and a second passkey — please do both before you need them.