What causes "Failed to connect to Rocket.Chat Cloud: ${response.statusText}" in RocketChat/Rocket.Chat?

From the server, curl -v the Cloud_Url registration endpoint to see who is actually answering and with what content-type.

RocketChat/Rocket.Chat · error · CloudWorkspaceConnectionError

Failed to connect to Rocket.Chat Cloud: ${response.statusTex

Error message

Failed to connect to Rocket.Chat Cloud: ${response.statusText}

What it means

The same non-ok branch in fetchRegistrationDataPayload, but response.json() threw because the body is not JSON, so the error falls back to the HTTP statusText ('Bad Gateway', 'Service Unavailable', ...). It means something other than the cloud API answered the request — typically an intermediary proxy, firewall, or the wrong Cloud_Url.

Source

Thrown at apps/meteor/server/lib/cloud/connectWorkspace.ts:37

	};
}) => {
	const cloudUrl = settings.get<string>('Cloud_Url');
	const response = await fetch(`${cloudUrl}/api/oauth/clients`, {
		method: 'POST',
		headers: {
			Authorization: `Bearer ${token}`,
		},
		body,
		// SECURITY: the URL is a default hardcoded value or an envvar/setting set by an admin. It's safe to disable this check.
		ignoreSsrfValidation: true,
	});

	if (!response.ok) {
		try {
			const { error } = await response.json();
			throw new CloudWorkspaceConnectionError(`Failed to connect to Rocket.Chat Cloud: ${error}`);
		} catch (error) {
			throw new CloudWorkspaceConnectionError(`Failed to connect to Rocket.Chat Cloud: ${response.statusText}`);
		}
	}

	const payload = await response.json();

	if (!payload) {
		return undefined;
	}

	return payload;
};

export async function connectWorkspace(token: string) {
	assertNotOfflineLicense();

	if (!token) {
		throw new CloudWorkspaceConnectionError('Invalid registration token');
	}

View on GitHub (pinned to b2c16d5842)

Solutions

From the server, curl -v the Cloud_Url registration endpoint to see who is actually answering and with what content-type.
Allowlist the cloud URL on proxies/firewalls and exempt it from TLS inspection.
Fix the Cloud_Url setting to the correct cloud API base URL.
If the cloud itself is down (502/503), retry later.

Defensive patterns

Strategy: try-catch

Validate before calling

const probe = await fetch(`${cloudUrl}/api/v2/register/workspace`, { method: 'OPTIONS' });
if (!probe.ok) {
  throw new Error(`cloud unreachable via ${cloudUrl}: ${probe.status} — check proxy/Cloud_Url`);
}

Try / catch

try {
  await connectWorkspace(token);
} catch (e) {
  if (e instanceof CloudWorkspaceConnectionError && /Bad Gateway|Service Unavailable|Forbidden/.test(e.message)) {
    // non-JSON intermediary response: inspect proxy/egress path, not cloud app logic
  }
  throw e;
}

Prevention

Smoke-test the cloud URL from the server (curl -v) before running registration flows.
Exempt cloud endpoints from TLS inspection and HTML error pages on egress proxies.
Alert on non-2xx non-JSON responses to distinguish infrastructure issues from cloud rejections.

When it happens

Trigger: A corporate proxy, captive portal, WAF, or TLS inspection device intercepts the call to the cloud register endpoint and returns an HTML/plain-text error page; or Cloud_Url is misconfigured so a generic web server answers 404/500.

Common situations: Egress-restricted networks with HTTP(S) inspection; Cloud_Url typos; cloud maintenance pages; gateway 502/503 during outages.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d3a7ab73ba9c610a. Report an issue: GitHub.