I can't sign in · BluAuth Docs

Sign-in problems usually have a small, specific cause. This page walks through the most common ones. Start at the top and stop at the first section that matches what you're seeing.

The basics

Did you recently reset your password?

If yes, try signing in with the new password. If that still doesn't work, try resetting again — browsers sometimes autofill the old password before you get a chance to type the new one. See how do I reset my password?.

Is the email address exactly right?

No leading or trailing spaces.
Case doesn't matter for most providers, but a misspelled domain does.
If your company changed domains recently (e.g. from oldcorp.com to newcorp.com), try both.

Is caps lock on?

Passwords are case-sensitive. If your password looks right but BluAuth says it's wrong, check the caps lock indicator. Many sign-in pages will show a small warning when caps lock is on — if you don't see that warning but feel like something's off, type your password into the email field (where you can see it) to verify, then retype it into the password field.

BluAuth offers two paths on most sign-in pages:

Email + password — type your email and password, click Sign in.
Enterprise sign-in — click the button for your identity provider (Google, Microsoft, Okta, etc.).

If you normally use the enterprise button, don't type your password — that'll fail with "invalid credentials" because you don't have one set. Click the enterprise button instead.

Account state

Did you see a "must reset password" prompt?

If your admin required a password reset, you'll see a screen asking for your current password and a new one. You have to complete this before you can continue. If you don't remember your current password, click Forgot your password? on that screen.

If an admin invited you:

The invitation link is valid for a limited time (usually 7 days).
Once you've used the link, you can't use it again.
If you're past that window, ask the admin to send a new one.

Is your account still active?

Admins can deactivate accounts. If yours has been deactivated, you'll see a message like "Your account has been deactivated. Please contact your administrator." Reach out to whoever manages BluAuth for your team — this isn't something you can fix on your own.

If the enterprise button used to be there and now it's gone — or you click it and get an "enterprise sign-in is not available" message — your admin may have turned that provider off. Use email and password, or ask your admin when it's coming back.

Is your email's domain blocked?

Some tenants only allow sign-ins from specific email domains. If you're trying to sign in with a personal address (gmail.com, yahoo.com, etc.) and your company only allows its own domain, you'll see a message like "this email address can't be used to sign in." Use your work email.

Two-factor codes

"Invalid code"

Make sure your phone's clock is set to automatic network time. TOTP codes are time-sensitive and even a 30-second drift breaks them.
Try waiting for the next code cycle rather than rushing — codes rotate every 30 seconds.
Are you looking at the right entry in your authenticator app? If you have multiple BluAuth accounts, codes aren't interchangeable.
If you've lost access to your authenticator, see two-factor authentication.

Browser and network problems

Browser extensions blocking cookies

BluAuth needs to set cookies to remember you're signing in. Privacy extensions like uBlock Origin, Privacy Badger, Ghostery, or aggressive ad blockers sometimes block the cookies BluAuth needs.

Try signing in with the extension temporarily disabled for auth.blutools.io (or your tenant's BluAuth subdomain).
Try a different browser — if Chrome fails and Firefox works, it's almost certainly an extension.
If you use private browsing permanently, switch to a normal window just for sign-in.

Third-party cookies disabled

If your browser is set to block all third-party cookies, the enterprise sign-in redirect will fail with a blank page or a loop back to the sign-in screen. Allow cookies for auth.blutools.io in your browser's cookie settings, then try again.

Corporate VPN intercepting the redirect

Some corporate VPNs rewrite URLs on the fly for content inspection. When that happens, the redirect URLs BluAuth sends to your identity provider can be mangled, and the sign-in loop never completes.

Try signing in with the VPN off (if policy allows).
Ask your IT to allowlist auth.blutools.io and your identity provider's domains (accounts.google.com, login.microsoftonline.com, okta.com, etc.) so they aren't rewritten.

Mobile in-app browsers

If you clicked a link from Slack, Teams, or a mobile email app, it may have opened in the app's built-in browser rather than Safari or Chrome. Many in-app browsers don't handle the redirects BluAuth needs, and some identity providers explicitly refuse to sign you in inside them.

Tap the three-dot menu in the in-app browser and choose Open in Safari or Open in Chrome.
Or copy the URL and paste it into your normal mobile browser.

Error messages, decoded

BluAuth shows specific error messages so your admin can diagnose the problem quickly. Here's what the common ones mean in plain language.

"Invalid state" or "state mismatch"

The sign-in flow takes a round trip between BluAuth and your identity provider, and the two sides didn't match up when you came back. Usually this happens because:

You opened the sign-in link on a different device or browser than where you started.
The browser cleared cookies between the start and end of the flow.
You waited too long — the flow times out after a few minutes.

Fix: Close the tab, go back to the app you were trying to sign into, and start over. Don't use the back button during sign-in.

"Provider error"

Something went wrong on your identity provider's side — Google, Microsoft, Okta, etc. BluAuth can't do anything about it directly. Try again in a few minutes. If it keeps happening:

Check your identity provider's status page (Google Workspace status, Microsoft 365 status, Okta status).
Sign in to your identity provider directly in another tab to make sure your account works there.
Ask your IT team if there's a known outage.

You clicked Cancel (or equivalent) on your identity provider's permission screen. BluAuth needs certain basic information (your email, your name) to sign you in — without it, there's nothing to do. Start over and click Allow when prompted.

"Account claimed by another user"

The email address returned by your identity provider already belongs to a different BluAuth account. This usually means a duplicate account exists for you. See why do I have multiple accounts?.

"Session expired"

Your sign-in session timed out before you finished. This is normal if you stepped away mid-flow. Start over. If it happens every time, see my session keeps expiring.

When to contact your admin vs. your IT help desk

Both can help, but they fix different things.

Contact your BluAuth admin when:

Your account is deactivated and needs to be reactivated.
You have duplicate accounts and need them merged.
Your 2FA needs to be reset because you lost your phone.
An invitation link expired and you need a new one.
You can't see a provider button that used to be there.

Contact your IT help desk when:

You can't get the password reset email at all (your corporate mail filter may be blocking it).
The VPN or a network proxy is breaking the sign-in redirect.
Your identity provider (Google, Microsoft, Okta) seems to be the problem.
You forgot your identity provider's password — that's your IT's territory, not BluAuth's.

Still stuck?

When you contact someone, include:

The exact email you're trying to sign in with.
Which sign-in method you're using (password vs. enterprise button).
The exact error message shown, word-for-word.
The time (approximately) you tried.
The browser and device you're on.
Whether it's happening on only one device or every device.
Whether you've recently changed anything — a new password, a new phone, a new browser, a new network.

With that information your admin can look up what happened from their side and usually resolve it in a few minutes.

Quick self-checks before you ask for help

Running through these takes two minutes and resolves most sign-in issues.

Try another browser

If sign-in fails in Chrome but works in Firefox (or vice versa), the problem is almost always a browser extension, a cookie setting, or cached data in the failing browser. Clearing cookies for auth.blutools.io and your identity provider's domain usually fixes it.

Try another network

If you're on a corporate network or VPN and sign-in fails, try switching to your phone's hotspot for a minute. If it works there, the network is the culprit — a proxy, a VPN, or a firewall rule is blocking part of the flow. Your IT team can help sort that out.

The sign-in page itself doesn't load at all, or shows a generic error page.
Every sign-in method fails in the same way at the same time.
Colleagues across different networks and devices all report the same issue simultaneously.

If that's what you're seeing, your admin or IT team probably already knows. Reach out to confirm and then wait — there's nothing you can do locally to fix a service outage.

How do I reset my password? — when the problem is the password itself.
I didn't get my password reset email — reset flow troubleshooting.
Why do I have multiple accounts? — for "account claimed by another user" errors.
My session keeps expiring — for "session expired" mid-flow.
Two-factor authentication — for 2FA code problems in depth.