# inrok CLI troubleshooting

Every error the CLI prints, what it means, and what to do. Messages are quoted
as the CLI emits them so you (or your AI assistant) can match them exactly.

## Login and credentials

**"not logged in — run `inrok login` first"**
No saved credentials on this machine. Run `inrok login` and paste an API key
from [app.inrok.in/settings](https://app.inrok.in/settings) → CLI access.

**"that doesn't look like an inrok key (expected inrok\_…)"**
API keys start with `inrok_`. You probably pasted something else (an email,
another tool's token, a truncated copy). Copy the full key from the dashboard.

**"key rejected — check it and try again"** (during `inrok login`)
The key didn't authenticate. It may have been revoked in the dashboard, or it
belongs to a different environment than the `--api-url` you're pointing at.

**"your key was rejected — run `inrok login` again"** (during any command)
The saved key was valid once but isn't anymore — most likely revoked from the
dashboard. Re-login with a fresh key.

## Tunnel names

**"this tunnel name belongs to a different inrok account…"**
The name was reserved while this machine was logged in as another user. Either
`inrok logout` then `inrok login` as the owning account, or pick a different
`--name`. Names are globally unique — first account to reserve one keeps it.

**"that name is still bound from a previous run — the fabric releases it
within a couple of minutes; retry shortly or pick a different --name"**
A previous share for that name hasn't fully deregistered yet (common right
after a hard kill). Transient — wait a minute or two and retry.

**"no tunnel named … — run `inrok status` to list them"** (from `inrok stop`)
`stop` matches the tunnel's name or its share name exactly. List them with
`inrok status` and copy the NAME column.

## Device enrollment

**"Setting up this device…" takes a moment on first run**
Normal: the first host command enrolls this machine with the tunneling fabric.
Subsequent runs are fast.

**"Device credentials were stale — re-enrolling and retrying…"**
Self-healing in progress, not an error. The CLI wipes its device state,
re-enrolls, and retries once automatically.

**"tunnel agent still unauthorized after re-enrolling — your account may be
suspended; contact support@inrok.in"**
Re-enrollment didn't fix it, which usually means the account is suspended
(e.g. over the bandwidth cap) or disabled. Check the dashboard; if your usage
looks fine, email support@inrok.in.

## Limits

**Tunnel creation fails with a limit message**
The free beta plan allows 3 tunnels. Release one with `inrok stop <name>` (or
delete it from the dashboard) and retry.

**Tunnel stops accepting traffic mid-month**
You've likely hit the monthly bandwidth cap (100 GiB on the free beta plan).
The dashboard banner confirms it; tunnels resume when your cycle resets.

**"fetch account setup" errors on first host command**
The account isn't fully provisioned yet — most commonly the email address
isn't verified. Open the verification link from your signup email, then retry.

## Network

**`inrok login` or any command hangs / times out**
The CLI talks to `https://app.inrok.in`. Check connectivity and any corporate
proxy. The tunnel data plane uses outbound TLS connections only — no inbound
ports or router changes are ever needed.

**Still stuck?**
Run `inrok version` and include its output plus the exact error message in a
mail to support@inrok.in.