When Hive cannot sign you in, it can show a page with the heading Authorization Error. The page shows the cause, the next step, and a Diagnostic code.
If you see this page
Under Diagnostic code, select Copy. If the button does not change to Copied, select the code with your mouse and copy it.
Send the code to your IT admin. If you are the IT admin, use the table below.
If you need more help, contact Hive support. Send the code, the date and time of the attempt with your time zone, and the email address that you use for Hive. Do not send your password.
The code does not contain your password or your email address. It is safe to send.
For IT admins: SSO (SAML) codes
The code starts with the reason. Find the reason in the table.
Code starts with | What it means | What to do |
| Hive could not verify the sign-in response from your identity provider (IdP). The certificate or the signature does not match, or the response is too old. | Make sure that the Certificate field in Hive has the current signing certificate from your IdP. If your IdP changed its certificate, paste the new one. Make sure that the clock of your IdP is correct. |
| Your IdP sent the sign-in response to a different Hive address than the one for this workspace. | Set the reply URL (ACS URL) in your IdP to the exact value in Your ACS URL in Hive. If you connect more than one Hive workspace, make sure that each app has its own workspace ID. |
| This sign-in response was already used. This usually occurs when the user reloads the page or goes back in the browser. | The user must go to the Hive sign-in page and sign in again. |
| Your IdP did not send an email address (NameID) with the sign-in. | Set the NameID of the Hive app to the email address of the user. |
| The email address from your IdP is almost the same as the email address of a Hive account, but not exactly the same. | Use the exact email address of the Hive account. If you cannot find the difference, contact Hive support with the code. |
| Hive could not add the user to the workspace. | If the page says Bad input, the NameID is not a valid email address. Set the NameID to the email address of the user. For other messages, a Hive workspace admin must check the member limit and the allowed email domains. |
| Hive cannot find a workspace with the ID in the SSO address. | Make sure that the workspace ID in the sign-in URL and in the ACS URL in your IdP is correct. Copy the values again from the Authentication page in Hive. |
| The SAML SSO URL or the Certificate field in Hive is empty. | A Hive System Admin must fill in the 2 fields on the Authentication page. |
To open the Authentication page: open Workspace settings. Under Advanced, select Security, then select Authentication. Only System Admins can edit the SSO fields. If the workspace has no System Admin, a workspace Admin can edit them.
Google and Microsoft sign-in
If the code starts with OAUTH-ADMIN-APPROVAL-REQUIRED or OAUTH-BLOCKED-BY-POLICY, your Microsoft or IT admin must allow Hive for your organization. See How to address the Microsoft message that says "Need Admin Approval".
If the code starts with OAUTH-DECLINED, the sign-in was cancelled. Go back to Hive and try again. For other codes that start with OAUTH, try again. If it fails again, contact Hive support with the code.
In the Hive web app, Hive closes the Google or Microsoft sign-in window when an error occurs, so you may not see a code. Try again. If it fails again, contact Hive support.