> ## Documentation Index > Fetch the complete documentation index at: https://docs.entire.com/llms.txt > Use this file to discover all available pages before exploring further. # Service Account Troubleshooting > Fix common service account access, binding, sign-in, and secret errors. In this section we cover what you can do when you can't bind a platform to a service account, a job can't sign in, or a signed-in job can't reach a repository. ## Access > [accordion] A Job Signs In but Can't Find the Repository > > The CLI reports `repo /et/acme/web not found or not shared with you`, or `git` reports `Repository not found`. > > The service account has no access to that repository. Check its grants: > > ```bash theme={null} > entire service-account grants acme/deploy > ``` > > Sign-in works even without a grant, so this is usually the first error you see. > [accordion] A Command Returns Permission Denied > > Some commands, such as `entire repo list`, need access to every repository in the project. Grant the service account access to the whole project: > > ```bash theme={null} > entire service-account grant acme/deploy --project acme --role reader > ``` ## Binding a Platform > [accordion] A Pin Value Is Refused > > `bind` reports `pin ... must match ...` or `pin ... must be exact, not a glob`. > > The value has the wrong format. See the format a platform expects: > > ```bash theme={null} > entire service-account providers github-actions > ``` > > Common causes: > > * **Cursor:** `repo_url` has a scheme or an upper-case host. Use the `host/path` form, such as `github.com/acme/web`. > * **Devin:** `organization` isn't a Devin organization ID. Copy it from the `sub` value of a token, or ask your Devin administrator. > * **Google Cloud:** the email has upper-case letters, or isn't a `gserviceaccount.com` address. > * **Vercel:** you used the team slug. Use the team ID from **Settings → General**. It starts with `team_`. > [accordion] A Required Pin Is Missing > > `bind` reports `... needs --pin for: ...`, or for Cursor, `pin at least one of team, user, service_account`. > > Add the pins the error names. A Cursor binding needs the repository plus your team, user, or Cursor service account. > [accordion] The Service Account Already Has a Binding > > `bind` reports `... already has a ... binding; unbind it first`. > > A service account holds one binding per platform. Find the existing binding and remove it: > > ```bash theme={null} > entire service-account bindings acme/deploy > entire service-account unbind acme/deploy > ``` ## Signing In with an OIDC Token > [accordion] No Binding Allows the Job to Sign In > > The exchange fails with `no binding authorises this subject to assume the target service account`. > > The service account has no binding for this platform, or the `resource` you sent names a different service account. Check its bindings: > > ```bash theme={null} > entire service-account bindings acme/deploy > ``` > [accordion] The Token Doesn't Match the Binding > > The exchange fails with `subject_token claims do not satisfy the binding's attribute filter`. > > One of the binding's pins doesn't match the job's token. Compare the pins from `entire service-account bindings` with the job: > > * **Amp:** the orb's project isn't the pinned one, or the thread has no project. Check which project the thread belongs to. > * **Buildkite:** compare `organization`, `pipeline`, and `branch` with `BUILDKITE_ORGANIZATION_SLUG`, `BUILDKITE_PIPELINE_SLUG`, and `BUILDKITE_BRANCH`. > * **Cursor:** the agent's primary repository, team, or runtime isn't the pinned one. > * **GitHub Actions:** compare `repository` with `github.repository` and `ref` with `github.ref`. > * **Google Cloud:** the token has no `email` claim, or the email doesn't match. Request the token with `--include-email` or `includeEmail: true`. > * **Vercel:** a preview deployment can't use a binding that pins `production`. A service account holds one Vercel binding, so bind a second service account to `preview`. > [accordion] The Token Is Invalid > > The exchange fails with `subject_token is invalid`. > > The token's audience isn't the `audience` value from `bind`, or the token has expired. Platform tokens expire within minutes, so exchange the token right after you get it. Devin tokens are especially short-lived. > > On Vercel, the project uses the Global issuer mode. Set it to **Team**. > [accordion] The Service Account Isn't Found > > The exchange fails with `service account not found`. > > The `resource` value isn't a service account ID. On GitHub Actions, check the `service-account` input. ## Platform-Specific Errors > [accordion] GitHub Actions: No OIDC Token > > `entireio/setup-entire` reports `No OIDC token: set id-token: write (forks get none).` > > Add `permissions: id-token: write` to the workflow or the job. GitHub doesn't issue an OIDC token to a `pull_request` run from a fork. > [accordion] Amp: No Token Outside an Orb > > `amp orb id-token` fails. > > `amp orb id-token` works only inside an orb. Run it in the orb, not on a runner or your own machine. > [accordion] Devin: devin-oidc Isn't Found > > The session reports `devin-oidc: command not found`. > > Add the `setup-devin-oidc` action to your environment blueprint. > [accordion] Google Cloud: gcloud Refuses --audiences > > `gcloud` reports `Invalid account type for --audiences. Requires valid service account.` > > You're signed in to `gcloud` as a person. Add `--impersonate-service-account`. ## Secrets > [accordion] The Secret Is Refused for Another Region > > The exchange fails with `invalid_grant` and names another region. > > The secret belongs to a service account in another region. Send it to the URL in the error message. > [accordion] The Secret Is About to Expire > > The exchange fails with `the secret expires within a minute`. > > Entire refuses a secret this close to its expiry. [Create a new secret](https://docs.entire.com/guides/configuration/service-accounts.md#sign-in-with-a-secret) and use it instead. > [accordion] The Secret Has Expired or Was Deleted > > A secret that worked before is refused. > > Check the service account's secrets: > > ```bash theme={null} > entire service-account secret list acme/deploy > ``` > > If the secret is missing or expired, [create a new one](https://docs.entire.com/guides/configuration/service-accounts.md#sign-in-with-a-secret). > [accordion] You've Hit a Limit > > `secret create` reports `service account already holds the maximum number of active secrets`, or `create` reports `service account limit reached`. > > A service account holds two unexpired secrets. Delete one before you create another. An organization or account can have up to 5 service accounts. > [accordion] Still Stuck? > > Include these details when asking for help: > > * `entire version` > * the service account, as `PROJECT/NAME` > * whether the job signs in with an OIDC token or a secret, and on which platform > * the full error message > > You can file an issue at [github.com/entireio/cli](https://github.com/entireio/cli) or ask in the [Entire Discord](https://discord.gg/jZJs3Tue4S). ## Continue With > [card] [Set Up a Service Account](https://docs.entire.com/guides/configuration/service-accounts.md#set-up-a-service-account) > > Create service accounts, grant access, and bind platforms in entire.com or with the CLI. > [card] [OpenID Connect (OIDC)](https://docs.entire.com/guides/configuration/oidc.md) > > Let a platform's jobs sign in with their own token.