Admin: FAQs & Troubleshooting
Answers to common Admin questions, and fixes for sign-in, team, and API key issues.
This page answers common questions about users, sign-in, teams, roles, and API keys. Use the troubleshooting entries when someone can't sign in or a dialog doesn't behave as expected.
FAQs
Users and sign-in
Can people sign up for Qore themselves?
No. Access is invite-only, whichever sign-in method someone uses. An administrator creates the account by inviting the person from Admin → Users. The sign-in page mentions creating an account, but it can't create one. See Users.
Which sign-in methods can people use?
Continue with Email is always available, using the password from the invitation. Continue with Google and Continue with Microsoft are turned on per Qore deployment, so a sign-in page can show both, one, or neither. Which methods are on isn't set from Control Center. See Single Sign-On.
Does Qore support multi-factor authentication?
Yes. When someone signs in with their organization's Microsoft Entra ID account, the organization's own Microsoft sign-in rules apply, including multi-factor authentication. Qore doesn't store their Microsoft password. See Sign in with Microsoft.
Does single sign-on give different access from a password?
No. What someone can do comes from their roles, however they sign in. Single sign-on proves who they are; the invitation decides whether they get in.
Roles
Can one person hold more than one role?
Yes. A person can hold several roles in one account, and their capabilities add up. Select one or more roles when you create or edit a user.
Does a role in one account apply in another?
No. Roles are held per account membership, so a role in one account doesn't carry into another. Organisation Admin's three tenant-level capabilities are the exception: they reach every account in the tenant. See Roles.
Who can manage users, teams, and API keys?
Only Account Admin and Organisation Admin. They carry Create user, Manage user, Remove a user, Manage teams, and Manage API keys. Developer, Governance Manager, and Auditor can view users, and Governance Manager can view teams. See Capabilities by role.
Can I create a custom role or change what a role grants?
Your organization's policies manage roles at the tenant level, and only Organisation Admin carries Manage organization roles. Roles your organization creates appear under Custom Roles in Admin → Roles. To request a change, contact your Organisation Admin.
Teams
What's the difference between a team role and an account role?
A team role (Admin or Member) applies only within one team. Account roles (Developer, Account Admin, and so on) are account-wide and govern everything else. You set both when you invite someone new from Create Team. See Teams.
What are a team's spaces?
The products the team can operate in: Console, Control Center, or both. Spaces are separate from the agent and app permissions you grant the team. See Create a team.
API keys
Which permissions can an API key carry?
Any of the account's capabilities, the same set that roles carry. Grant the key only the ones it needs. See Create an API key.
Can I call an agent with the key from Admin → API Keys?
No. The platform key from Admin → API Keys is sent as x-platform-key and isn't accepted by agent runtime routes. To call an agent, use its agent key or widget key from the agent's Deploy tab. See Integrate Agent.
Do API keys expire?
No. None of the key types expire or support rotation today. To stop a platform key from being used, select Revoke in its Actions menu. See Manage a key.
Troubleshooting
Sign-in
Someone gets a validation error when they try to sign in
Their email address hasn't been invited. Invite that exact address from Admin → Users, then ask them to try again. See Access is invite-only.
Someone can't sign in with Google or Microsoft, even though they were invited
The address on their Google or Microsoft account must match the invited email exactly. A person invited as [email protected] can't sign in with Microsoft as [email protected], even if both reach the same mailbox. Invite the address their Google or Microsoft account actually uses.
The Continue with Google or Continue with Microsoft button is missing
Each single sign-on button is turned on per Qore deployment, and it isn't set from Control Center. When none is on, the sign-in page shows only Continue with Email. Ask your Qore administrator for the method you need.
The temporary password email hasn't arrived
Wait a few minutes, then check the spam or junk folder. A temporary password goes only to the invited email address shown on the confirmation. See Reset a forgotten password.
Someone who signs in with Google wants to reset their password
People who only ever sign in with Google don't have a Qore password to reset. They should use Continue with Google.
Update Password stays unavailable
Fill all three fields: Current Password (the temporary password), New Password, and Confirm Password. The button becomes available once all three are filled. See Set your own password.
Teams
A new team's agent or app selections weren't saved
The selections are saved only when you finish both steps of Create Team and select Create Team in step 2. Open the team and add them from Data Permissions. See Manage an existing team.
Changes to a team's members or permissions didn't apply
Changes in a team's dialog apply only when you select Save & close. Open the team, make the changes again, and select Save & close.
API keys
Create Key stays unavailable
Enter a Key name and select at least one permission. The button becomes available once both are set.
I didn't copy a new key before closing the dialog
A key is shown only once, when it's created, and can't be retrieved later. Create a new key and copy it before you select Done. You can revoke the key you lost from its Actions menu.
An agent runtime route rejects the key
Agent runtime routes don't accept the platform key (x-platform-key). Use the agent's agent key (x-api-key plus its secret) or widget key (x-widget-key plus a whitelisted domain) from its Deploy tab. See Integrate Agent.
Roles
Someone can't stop or resume an agent
Only Account Admin and Organisation Admin can stop or resume agents. Governance Manager and Auditor can view agent controls but can't change them. See Roles.
Someone needs a capability their roles don't include
Capabilities add up across roles, so give them a role that includes it, as well as the roles they already hold. For example, Approver approves publishing but doesn't build, so an Approver who also needs to build agents needs the Developer role too. Check which roles carry a capability in Capabilities by role. To change what a role grants, contact your Organisation Admin.
Related
Maintained by Abhishek Paul
AI-assisted, human-approved
Last updated
Was this helpful?