Skip to main content
In this section we cover what you can do when you can’t bind a platform to a service account, a job can’t sign in, or a signed-in job can’t reach a repository.

​
Access

The CLI reports repo /et/acme/web not found or not shared with you, or git reports Repository not found.The service account has no access to that repository. Check its grants:
Sign-in works even without a grant, so this is usually the first error you see.
Some commands, such as entire repo list, need access to every repository in the project. Grant the service account access to the whole project:

​
Binding a Platform

bind reports pin ... must match ... or pin ... must be exact, not a glob.The value has the wrong format. See the format a platform expects:
Common causes:
  • Cursor: repo_url has a scheme or an upper-case host. Use the host/path form, such as github.com/acme/web.
  • Devin: organization isn’t a Devin organization ID. Copy it from the sub value of a token, or ask your Devin administrator.
  • Google Cloud: the email has upper-case letters, or isn’t a gserviceaccount.com address.
  • Vercel: you used the team slug. Use the team ID from Settings → General. It starts with team_.
bind reports ... needs --pin for: ..., or for Cursor, pin at least one of team, user, service_account.Add the pins the error names. A Cursor binding needs the repository plus your team, user, or Cursor service account.
bind reports ... already has a ... binding; unbind it first.A service account holds one binding per platform. Find the existing binding and remove it:

​
Signing In with an OIDC Token

The exchange fails with no binding authorises this subject to assume the target service account.The service account has no binding for this platform, or the resource you sent names a different service account. Check its bindings:
The exchange fails with subject_token claims do not satisfy the binding's attribute filter.One of the binding’s pins doesn’t match the job’s token. Compare the pins from entire service-account bindings with the job:
  • Amp: the orb’s project isn’t the pinned one, or the thread has no project. Check which project the thread belongs to.
  • Buildkite: compare organization, pipeline, and branch with BUILDKITE_ORGANIZATION_SLUG, BUILDKITE_PIPELINE_SLUG, and BUILDKITE_BRANCH.
  • Cursor: the agent’s primary repository, team, or runtime isn’t the pinned one.
  • GitHub Actions: compare repository with github.repository and ref with github.ref.
  • Google Cloud: the token has no email claim, or the email doesn’t match. Request the token with --include-email or includeEmail: true.
  • Vercel: a preview deployment can’t use a binding that pins production. A service account holds one Vercel binding, so bind a second service account to preview.
The exchange fails with subject_token is invalid.The token’s audience isn’t the audience value from bind, or the token has expired. Platform tokens expire within minutes, so exchange the token right after you get it. Devin tokens are especially short-lived.On Vercel, the project uses the Global issuer mode. Set it to Team.
The exchange fails with service account not found.The resource value isn’t a service account ID. On GitHub Actions, check the service-account input.

​
Platform-Specific Errors

entireio/setup-entire reports No OIDC token: set id-token: write (forks get none).Add permissions: id-token: write to the workflow or the job. GitHub doesn’t issue an OIDC token to a pull_request run from a fork.
amp orb id-token fails.amp orb id-token works only inside an orb. Run it in the orb, not on a runner or your own machine.
The session reports devin-oidc: command not found.Add the setup-devin-oidc action to your environment blueprint.
gcloud reports Invalid account type for --audiences. Requires valid service account.You’re signed in to gcloud as a person. Add --impersonate-service-account.

​
Secrets

The exchange fails with invalid_grant and names another region.The secret belongs to a service account in another region. Send it to the URL in the error message.
The exchange fails with the secret expires within a minute.Entire refuses a secret this close to its expiry. Create a new secret and use it instead.
A secret that worked before is refused.Check the service account’s secrets:
If the secret is missing or expired, create a new one.
secret create reports service account already holds the maximum number of active secrets, or create reports service account limit reached.A service account holds two unexpired secrets. Delete one before you create another. An organization or account can have up to 5 service accounts.
Include these details when asking for help:
  • entire version
  • the service account, as PROJECT/NAME
  • whether the job signs in with an OIDC token or a secret, and on which platform
  • the full error message
You can file an issue at github.com/entireio/cli or ask in the Entire Discord.

​
Continue With

Set Up a Service Account

Create service accounts, grant access, and bind platforms in entire.com or with the CLI.

OpenID Connect (OIDC)

Let a platform’s jobs sign in with their own token.