different-ai/openwork · error · Error

Could not resolve workspace SSO (${response.status}).

Error message

Could not resolve workspace SSO (${response.status}).

What it means

den-flow-provider.tsx throws this as the generic fallback when `GET /v1/orgs/sso/resolve` returns any non-ok status other than 403, embedding the status code. It covers timeouts, 4xx client errors, and 5xx server errors during SSO resolution.

Source

Thrown at ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx:441

    setVerificationCode("");
    setAuthInfo(message ?? `Enter the 6-digit code we sent to ${targetEmail}.`);
    setAuthError(null);
    setSignupPasswordFeedback([]);
  }

  function cancelVerification() {
    setVerificationRequired(false);
    setVerificationCode("");
    setAuthInfo(getAuthInfoForMode(authMode));
    setAuthError(null);
    setSignupPasswordFeedback([]);
  }

  async function redirectToRequiredSso(trimmedEmail: string) {
    const { response, payload } = await requestJson(`/v1/orgs/sso/resolve?email=${encodeURIComponent(trimmedEmail)}`, { method: "GET" }, 12000);

    if (!response.ok) {
      throw new Error(getErrorMessage(payload, response.status === 403 ? "We could not verify this sign-in attempt. Please refresh and try again." : `Could not resolve workspace SSO (${response.status}).`));
    }

    const method = typeof (payload as { method?: unknown } | null)?.method === "string"
      ? (payload as { method: string }).method
      : "";
    if (method !== "sso") {
      return false;
    }

    const signInUrl = typeof (payload as { signInUrl?: unknown } | null)?.signInUrl === "string"
      ? (payload as { signInUrl: string }).signInUrl
      : "";
    if (!signInUrl) {
      return false;
    }

    const nextUrl = new URL(signInUrl, window.location.origin);
    nextUrl.searchParams.set("callbackURL", getSocialCallbackUrl());

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Verify the email domain is configured for SSO in the org settings
2. Check the interpolated status code and the corresponding server logs
3. Retry after confirming the identity provider is healthy (5xx is often upstream)
4. Check for rate limiting (429) and back off before retrying

const email = trimmedEmail;
if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
  setError("Enter a valid work email.");
  return;
}

try {
  await redirectToRequiredSso(email);
} catch (err) {
  const m = err.message.match(/\((\d{3})\)/);
  const status = m ? Number(m[1]) : 0;
  if (status === 429) showError("Too many attempts. Wait a minute and try again.");
  else if (status >= 500) retryWithBackoff(() => redirectToRequiredSso(email));
  else showError("No workspace SSO found for this email. Check the address or contact your admin.");
}

When it happens

Trigger: The 12-second request to `/v1/orgs/sso/resolve?email=...` returns 400 (malformed email), 401 (no session), 404 (no org for the email domain), 429 (rate limited), or 5xx, and the payload has no extractable message.

Common situations: Typo'd or personal-email domain with no SSO mapping (404); identity provider (Okta/Entra) outage causing upstream 502; user hammering the endpoint and getting rate limited; Den server unreachable.

Related errors

• Failed to load SSO settings (${response.status}).
• Failed to save SSO settings (${response.status}).
• Failed to delete SSO settings (${response.status}).
• Failed to request domain verification (${response.status}).
• Failed to verify domain (${response.status}).

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/e31dc4ead11f880b. Report an issue: GitHub.