Troubleshooting

Your login has expired. Run 'source-coop auth login'. The session's refresh token expired or was revoked. Sign in again. source-coop auth status estimates when it expires.

Couldn't get new credentials (…). Run 'source-coop auth login'. creds could not renew a role's credentials. AWS tools show this message as their own error. The reason is in the brackets. Usually the session has expired, so sign in again. The message also says that public data needs no credentials (see Access Data).

macOS asks for your keychain password. macOS asks the first time a new build reads the source-coop-cli keychain items, for example after an upgrade. Select Always Allow so that it does not ask again until the next upgrade.

AccessDenied from AWS tools. The data proxy refused the request. To read a product that is not public, or to write to any product, you must be a member with a role that allows it. Writes have more conditions, in Uploading data. Check your role with source-coop member list ACCOUNT (the organization) or ACCOUNT/PRODUCT.

Exit code 4 or 5. A command exits with 4 when you are not signed in or not allowed, and 5 when the record does not exist. With --json, the error on stderr gives the HTTP status and, if the API sent one, a request_id. See Exit codes.

A GitHub workflow cannot sign in as a service account. The trusted subject must match what GitHub puts in the workflow's token, character for character. See Sign-ins for how the CLI finds the repository's subject.

Reporting a problem. Open an issue with source-coop --version, the command, and the request_id from the error if there is one.