Logging on runs through several steps: the licence decides which platforms are offered, the platform authorises the user through OAuth, and the token obtained is kept in [[Invantive Keychain]]. A failure in any of the three is reported at the moment of logging on, which is why the codes seen here come from very different parts of the product. `itgenuty726` is a case of its own: it is historically the catch-all for a failed log on and says only that a connection could not be established. Recent releases split it, so a newer release often names the actual cause where an older one gave `itgenuty726`. ## The Platform Is Not Offered The log-on window shows only the platforms the licence covers. A Public Data licence key offers a handful of public sources and no Exact Online, which is the usual explanation for a platform which "has disappeared" after a licence key was replaced. - Load the licence key of the subscription; see [[Licence Is Refused]]. - Where the list is stale rather than wrong, run discovery again with the "Edit" button in the log-on window and close that window when it finishes. - Restart Microsoft Excel completely afterwards. ## The Redirect URL Is Refused `itgeneor695` reports that the redirect URL is not allowed for this product. The redirect URL of Invantive Cloud, `https://cloud.invantive.com/app/setup/database/new/exactonline/token`, works only on Invantive Cloud. An on-premises product such as Invantive Control for Excel uses `https://clientredirect.invantive.com` or a redirect URL of your own over HTTPS. The separation is not cosmetic. Sharing one app registration between Invantive Cloud and an on-premises product breaks the chain of refresh tokens on Invantive Cloud, after which the data containers there start failing. Register a separate app for the on-premises product; see [[Own Client ID for Exact Online]]. ## The Token Is No Longer Accepted - `itgeneor823`, `itgeneor825` and `itgenoda220`: the OAuth access token has expired or is not being accepted, with `401 Not authorised` from the platform. - `itgenerr072`, `itgenoda044` and `itgenuut005`: there is no OAuth token to put in the request at all. `itgenuut005` additionally means that ten or more formula calculations failed during one recalculation, upon which the run is broken off rather than continued. An access token lives for about ten minutes and is refreshed silently. It stops being accepted when the same platform user logs on elsewhere with the same client ID, so two devices sharing one account displace each other. Logging on again is then the remedy, not a repair. Where logging on again does not help, the stored credentials themselves are suspect. Renaming `%USERPROFILE%\Invantive\invantive-own-v2.keychain` makes the product start with an empty [[Invantive Keychain]]; everything stored in it has to be entered once more, so rename rather than delete. ## Exact Online One Exact Identity The migration to One Exact Identity changed how Exact Online authenticates, and it is behind a large share of the log-on failures reported since. Two points are worth knowing before looking further. - A release older than July 2023 does not work with One Exact Identity at all. Upgrade first; the same holds for release 22.0, which does not co-operate with it. - `itgenoam005`, in recent releases `itgenoma060`: the One Exact Identity account is configured for several users, which API connections do not support. Every user needs an account of their own. This is a rule of the Exact Online APIs and applies to every app, so it cannot be worked around in Invantive Control for Excel. A log-on window which keeps alternating between "log on with your user name" and "log on with your e-mail address" is a symptom of an account which was not converted cleanly. That is settled with the support desk of the platform. Creating a new user in Exact Online and logging on with that user is the workaround which most often succeeds. ## The E-mail Address Is Not Accepted - `itgenuty311`, `itgenuty512` and `itgeneuy044`: the e-mail address supplied could not be validated, or is invalid. The address is checked by resolving the DNS MX record and the A record of its domain. The check therefore fails on a device which cannot resolve DNS, on a domain which publishes neither record, and while the network is slow enough for the lookup to time out. Verify the resolution from the device itself with `nslookup`; an address in another domain establishes quickly whether the domain or the device is at fault. ## The Workbook Cannot Be Activated `itgenuty425` reports that Invantive Control for Excel can only be enabled on a workbook without password protection. The product needs access to parts of the workbook which protection closes off, so protection set in Microsoft Excel itself, on the structure or on the windows, blocks activation. Remove that protection from the workbook and enable the product again. Protection is thereafter a matter for the model rather than for Microsoft Excel; see [[Invantive Control for Excel/Concepts/Protection|Protection]].