Troubleshooting

Save & verify fails

Save & verify mints a real Cloudpath JWT against the Core surface, so a failure is always in the credentials chain. In order of likelihood:

1. Wrong password or username. Re-enter the password — it is write-only, so you can’t inspect what’s stored. A bad login surfaces as login_failed.
2. FQDN not a bare hostname. The field must be a hostname only — no https:// and no path. https://host/foo is rejected with “fqdn must be a bare hostname (no scheme, no path)”.
3. Self-signed or untrusted TLS certificate. See below.
4. Host unreachable. A DNS or network failure to the FQDN surfaces as invalid_host.
5. Host not publicly routable. A private, loopback, or link-local address, or an internal-only name, is rejected as forbidden_host. See below.

Tip

If the save reported “Saved.” rather than “Saved and verified.”, nothing was checked — verification only runs when you type a password. Click Test connection to verify the stored credentials without retyping them.

Every error code, and what clears it

Failures come back as a stable code, from the dashboard and from Claude alike.

Code	Meaning	Fix
no_credentials	No Cloudpath credentials saved for this account, or they were deleted	Save them in the dashboard
login_failed	Cloudpath rejected the username or password	Re-enter the password; confirm the account is not locked or expired in Cloudpath
invalid_host	The FQDN could not be reached — DNS failure, connection refused, TLS rejected, or a timeout	Check the hostname and that it is reachable from the public internet with a trusted certificate
forbidden_host	The FQDN is a private, loopback, link-local, CGNAT, or multicast address, an IPv4 address not written in dotted decimal (such as 2130706433 or 127.1), or a name ending .local, .internal, or .localhost	Give CP-MCP a publicly routable FQDN
decryption_failed	The stored ciphertext could not be decrypted	Re-save the password; if it recurs, contact support
missing_property_portal	A property.call was made without propertyMgmtPortalGuid	Pass the portal GUID — see below
invalid_body	Both body and bodyBase64 were passed to one call	Pass exactly one

These arrive as a structured result, not a thrown error: ok: false, status: 0, and statusText: "cp_auth_error", with the code in body.error. A status of 0 is the tell that the call never reached Cloudpath.

My Cloudpath is on a private network

CP-MCP runs on Cloudflare and reaches your Cloudpath across the public internet, so an internal-only deployment cannot work. Saving an address in a private range — or a name ending .local, .internal, or .localhost — is rejected outright as forbidden_host; the check exists so the Worker cannot be pointed at someone else’s internal network.

Publish the Cloudpath server at a public FQDN with a publicly trusted certificate. A public name that resolves to a private address passes the forbidden_host check but then fails to connect, surfacing as invalid_host. See Security model.

My Cloudpath uses a self-signed certificate

It won’t work. Cloudflare Workers reject self-signed certificates on outbound HTTPS and offer no skip-verify option. Install a publicly trusted certificate on your Cloudpath server. Cloud-hosted Cloudpath at *.cloudpath.net already presents a valid certificate. See Security model.

The connector won’t authorize

• Redirect loop or “too many redirects” — a cookie problem during the Google sign-in hop. Use a normal (non-private) window, allow cookies for cp-mcp.lanpulse.com, remove the connector, and add it again.
• “Not authenticated” on every call — the token was revoked, or the connector was added before sign-in completed. Remove and re-add it.
• Connector connects, but calls fail on credentials — MCP auth is fine and Cloudpath auth isn’t. Click Test connection in the dashboard; it re-mints against the stored password and names the failure.

See Connecting to Claude.

”No Cloudpath credentials configured”

The connector is authorized but you haven’t saved Cloudpath credentials for this account — or you deleted them. Sign in to the dashboard and save your FQDN, username, and password. This surfaces to Claude as the no_credentials error.

Property-surface calls fail

• missing_property_portal — a property.call was made without propertyMgmtPortalGuid. Every Property Management call must be scoped to a portal GUID. See The three API surfaces.

A call returns ok: false but nothing threw

That’s by design — call never throws on an HTTP error; it returns a result with ok: false and the status. Inspect status and body to see what Cloudpath said. See Calling conventions.

A portal logo or favicon uploaded but appears blank

The multipart text field name was wrong or missing. Cloudpath reads the filename field for logos and iconFilename for favicons — the wrong name returns 200 OK but silently clears the stored image. See Generating portal images.

The request timed out or died part-way

Two separate clocks can end a code_mode program:

• code_mode exceeded 20000ms wallclock budget — the whole program ran too long. Narrow the ask: one pool, one property, one page at a time.
• A single call returning ok: false with status: 0 and a timeout message — that one Cloudpath request passed its 15-second limit while the rest of the program was still fine.

A long pagination loop can also trip Cloudpath’s own rate limit (180 requests per minute on cloud-hosted deployments). That is a rejection from Cloudpath, not a CP-MCP error, so it arrives as an ordinary ok: false carrying whatever status Cloudpath returned. See Limits and quotas.

Still stuck?

Contact support with the FQDN, the surface you were calling, and the status and body from the failing call.

Getting started The credentials form, the dashboard controls, and what each one verifies.

Calling conventions The return shape, the automatic token retry, and how to read a failed call.

Limits and quotas Every timeout, size cap, and rate limit in one place.

Security model TLS and routability requirements, and how to revoke access.