Skip to main content
Each entry below names the symptom the way you would describe it, then gives the cause and the fix.

​
Startup and access

Compose exits with a message about POSTGRES_PASSWORD or AUTH_SECRET. Both are required in the root .env and Compose refuses to start when either is missing or empty. Generate them, then start again.
Two settings stop the API at boot.
  • AUTH_SECRET is shorter than 32 characters. The API refuses to run with a weak signing secret. Generate one with openssl rand -hex 32 and recreate the API container.
  • AUTH_COOKIE_SECURE is false while NODE_ENV is production, which the Docker image always sets. The log reads AUTH_COOKIE_SECURE must be true when NODE_ENV is production. Set it back to true and see Sessions do not persist behind a proxy for ways to reach the stack without TLS. See What the API refuses to start with.
Registration closed automatically once the owner account existed, which is the default. Set AUTH_ALLOW_REGISTRATION=true and restart the API. See Authentication and accounts.
AUTH_SECRET changed, which invalidates every session signature. Personal API tokens are unaffected. See Rotate secrets.
AUTH_COOKIE_SECURE=true marks the cookie Secure, so a browser reaching the site over plain HTTP from another machine discards it. Setting it to false is not an option, because the Docker image then refuses to boot. Pick one of these instead.
  • Terminate TLS in front of port 3001 with your own reverse proxy and certificate.
  • Compose the Cloudflare Tunnel overlay, which terminates TLS at Cloudflare.
  • Forward the port over SSH and open http://localhost:3001. Browsers treat localhost as a secure context and keep a Secure cookie there without TLS.
See Hosting behind TLS and a reverse proxy.

​
Admin surfaces

You are not signed in as the owner in that browser. The surface answers 404 rather than 403 so it does not confirm it exists. Sign in and reload, or check that BULL_BOARD_ENABLED is not false. See The queue dashboard and the OpenAPI surface.
API_DOCS defaults to owner, which gates the documentation routes the same way. Sign in as the owner, or set API_DOCS=public if the surface should be readable by anyone. See The queue dashboard and the OpenAPI surface.

​
Collection

The daily pipeline starts at CRON_DAILY, which defaults to 0 3 * * * and is evaluated in UTC rather than in your local timezone. Check pipeline.lastDailyRunAt on /api/backend/health, then look at the queue dashboard for stuck or failed jobs. See The daily pipeline and rate limits.
The parser canary confirmed that a store stopped parsing, so collection is paused for that store. The banner appears after two consecutive failing canary runs rather than on the first, so a single blip is never announced, and it clears on its own within a minute of the canary returning ok. Your stored history is untouched: a break pauses collection, it does not remove anything. Nothing on your side needs changing. See Recover from a broken store parser.
Not a failure. The keyword was checked and the app was not found within the captured depth, which defaults to 200. The bound is read from that row’s own depth. See Positions and rank depth.
Both workers run at concurrency 1 behind a rate limiter, so a large keyword and market count simply takes longer. Check the request budget card on the settings page or GET /jobs/budget. Remove keywords or markets rather than raising the limits, which risks the store throttling your IP address. See The daily pipeline and rate limits.
Failed jobs from before the upgrade are still counted. The badge reads the failed job count of the store and alert queues, and a failed job stays in that count until it is removed, so failures from a keyword the upgrade paused keep the badge degraded. Sign in as the owner, open /admin/queues, select the store queue, open its failed jobs and clean them. The badge recovers on the next health check. See The queue dashboard and the OpenAPI surface.
A store changed a response shape. The failure is contained to the provider layer, the job fails, and BullMQ retries it with backoff while request handling continues. See Recover from a broken store parser for triage, containment and recovery.

​
Alerts and AI

The endpoint returned a non 2xx status, which the delivery log records per channel on the settings page. Fix the endpoint, then use flush now to claim the facts currently pending. See Send alerts.
Email stays disabled until both SMTP_HOST and SMTP_FROM are set. One without the other leaves it off. Check the delivery log for a relay rejection, which usually means the envelope sender is not on a domain the relay accepts.
Account email is recorded like alert email. Every attempt writes a row to the delivery log on the account channel, with the event naming what it was for, verification, recovery or invitation, and one of three outcomes.Read the rows with the database the deployment already has.
The same outcomes are counted in /metrics as asobeast_account_mail_attempts over the last day, and mail.failures.clustered fires once a fifth of the attempts are being refused. See Hosted observability.The relay is verified once before the first message of a process, so a wrong host, port or credential fails with the relay’s own response rather than being discovered by a customer who never got their link.
OPENAI_API_KEY is unset, which disables the AI audit, the metadata drafts card and action explanations. Every other feature works without it. See Enable the optional AI features.

​
Still stuck?

Collect the bounded diagnostics below and open an issue with them.
Never paste the output of docker compose config into an issue. It contains the resolved database password, and with the tunnel overlay composed it also contains the Cloudflare Tunnel token, which is enough to route traffic through your tunnel.
Last modified on September 15, 2026