# When someone cannot sign in

The common cases, in the order they actually occur.

## "This account can't open the admin console"

The identity is valid but has no admin record. Nearly always **passkey autofill picked the
wrong saved account** — someone with both a personal and a work identity on the same
machine. Sign out, sign in again, and choose deliberately.

The other possibility is that they are a developer, not an admin. Developers do not use
the console.

## The invite link does not work

Invites are single-use and they expire. **Users & Teams → Pending & past invites** shows
the status: `pending`, `accepted`, `expired` or `revoked`. **Resend** issues a fresh link
and invalidates the old one.

## They lost the device with their passkey

**Resend passkey** on their row in the admin table. They get a new setup link and can
register a passkey on a new device. Their old passkey stays registered until they remove
it — worth cleaning up if the device is genuinely gone rather than merely replaced.

## SSO worked yesterday and does not today

Check **Organization SSO**: the status badge shows **Failing** when validation against
your provider stops succeeding. The usual cause is an expired client secret. Edit the
configuration, put in the new secret, re-run the test login.

## Nobody can get in at all

If every admin has lost access, open a ticket from any other channel you have with us. This
is exactly why the console asks you to have a second admin and a second passkey — please
do both before you need them.