> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Connection error messages
> Every message DSALTA shows when a connection fails, what it actually means, and what to do.
When a connection is rejected, DSALTA replaces the provider's raw response with one of a small set of sentences. That keeps stack traces and tokens off your screen, but it also means **the message is deliberately generic** — the same sentence covers many underlying causes.
This page lists every message the connection layer can produce and what each one narrows the problem down to.
**Where to find the message.** Open **Integrations**, click **Manage** on the integration's card, and open the **Status** tab. A failed connection shows **Connection issues detected** with the stored message underneath. The integration card itself shows no error state, so the Status tab is the only place to look.
## What each message means
| Message | What it means | What to do |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authentication failed — the credentials are invalid, expired, or revoked. Re-check or regenerate them and try again.** | The provider rejected the credential outright: HTTP 401, or a response containing *bad credentials*, *unauthenticated*, *invalid token*, or *token expired*. | Regenerate the token or key at the provider and connect again. If it worked yesterday, it was probably rotated or revoked. |
| **Access denied — the credentials are missing required permissions or scopes (or need org/SSO authorization). Grant the needed read access and try again.** | HTTP 403. The credential is valid but not allowed to read what DSALTA asked for. | Compare the credential against the scopes listed on the integration's page. On GitHub and similar, also check whether the token needs org approval or SSO authorization. |
| **Access denied — the credentials are missing required permissions or scopes. Grant the needed read access and try again.** | The same problem recognized from wording rather than a status code (*permission denied*, *forbidden*, *not authorized*, *insufficient*). Identical cause; the sentence just omits the SSO clause. | As above. |
| **Not found — check the workspace, organization, or resource identifier, and that the credentials can access it.** | HTTP 404. Usually a wrong subdomain, organization slug, tenant or account identifier — or a credential scoped to a different organization than the one you named. | Re-check the identifier you entered. Several providers scope a token to one organization, so a token created while viewing the wrong one produces this. |
| **Not found — check the identifier and that the credentials can access it.** | The same problem recognized from wording (*not found*, *does not exist*, *no such*) instead of a 404. | As above. |
| **The provider rejected the request: …** | HTTP 409 or 422, or wording like *invalid argument* / *bad request* / *malformed*, **and** DSALTA could safely extract the provider's own explanation. | Read the appended explanation — it is the provider's wording, not DSALTA's. |
| **The provider rejected the request. Re-check the entered values and try again.** | The same case, but no explanation could be extracted. | Re-check every value you typed, especially identifiers and region or domain fields. |
| **Rate limit reached. Please wait a moment and try again.** | HTTP 429, or *rate limit* / *too many requests* / *resource exhausted*. | Wait and retry. If it recurs on every attempt, the credential is probably shared with another heavy consumer. |
| **The provider is temporarily unavailable. Please try again shortly.** | The provider returned 500, 502, 503, or 504. | Nothing to fix on your side. Retry later. |
| **Could not reach the provider. Check connectivity and try again shortly.** | A network-level failure — timeout, DNS, connection refused. | Check whether the provider is reachable from the public internet and whether an IP allowlist is blocking DSALTA. |
| **Could not connect to *\*. Please re-check the credentials and try again.** | The fallback when the response was recognizably technical but matched none of the cases above. | Work through the integration's setup requirements, then re-enter the credential. If it persists, [contact support](/troubleshooting/contact-us) — the raw response is in DSALTA's logs even though it is not shown to you. |
| **Connection failed. Please re-check the credentials and try again.** | The same fallback when DSALTA has no integration name to include, or the provider returned no message at all. | As above. |
### Google Cloud only
| Message | What it means | What to do |
| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| **A required Google Cloud API is not enabled for this project.** | The service account is valid but an API DSALTA needs is switched off for that project. GCP usually names the specific API and appends the activation URL. | Open the named API's activation link, enable it, wait about a minute, and retry. |
| **Billing is not enabled for this Google Cloud project.** | The project has no billing account linked. | Link a billing account and retry. |
Google Cloud composes these messages itself and deliberately keeps them under 235 characters so they survive the rewrite described below. That is why GCP errors name the exact API and include a link, while most other integrations do not.
## Why the message is sometimes vaguer than the cause
**A generic message does not mean DSALTA has no detail.** Any provider response containing technical markers **or longer than 240 characters** is replaced wholesale before you see it. Some integrations therefore lose their most useful diagnostic.
The clearest example is GitHub. When a fine-grained token is still **pending an organization owner's approval**, GitHub's adapter writes a 435-character explanation naming the exact approval path — and because it exceeds 240 characters it is discarded and you see only *"Authentication failed — the credentials are invalid, expired, or revoked."* GitHub's shorter 403 message survives intact, so the same integration is more helpful about scopes than about pending approval.
If a connection keeps failing and the message is generic, work from the integration's setup requirements rather than the message — and contact support, who can see the original response.
**Pending GitHub approval is worth ruling out first.** A fine-grained token scoped to an organization you do not own stays pending — and is rejected — until an owner approves it at **Organization → Settings → Third-party access → Personal access tokens → Pending requests → Approve**. It looks exactly like an expired token from the message alone.
## Before you retry
Reconnecting is not free. There is no Reconnect button, so restoring a broken connection means **Disconnect** then **Connect** — and disconnecting permanently deletes the data and tests already collected from that integration. Read [Integration errors](/troubleshooting/integration-errors) first.
## Related pages
* [Integration errors](/troubleshooting/integration-errors)
* [Understanding test results](/guides/data-library/test-results)
* [Integrations overview](/integrations/overview)