IAA BOT
IAA BOT Troubleshooting
Diagnose website, OAuth, authorization, API, HMAC, nonce, permissions, workflow, and synchronization problems.
Common problems#
| Problem | How to diagnose and fix |
|---|---|
| /authorize fails | Check IAA_AUTHORIZE_URL, POST /authorize/sessions, HTTPS, bot-to-backend authentication, and backend logs. |
| /lookup shows no authorization | Confirm the same Discord user completed OAuth and the backend authorization endpoint returns an active record. |
| API returns unauthorized | Compare bearer API key values and confirm no whitespace or proxy header removal. |
| Invalid signature | Compare method, path/query, timestamp, nonce, exact body bytes, SHA256 encoding, and signing secret. |
| Nonce rejected | Generate a unique nonce for every request; do not retry with the same signed request. |
| Expired timestamp | Synchronize server clocks and use the current timestamp within backend tolerance. |
| Staff action denied | Check backend staff access, role mappings, permission cache, and guild membership. |
| Workflow posts locally but not on website | Check the workflow API response, website ID, decision route, and local iaa_workflows.sqlite3 state. |
| Role or channel is 0 | The local buyer_config entry is unconfigured; enter the required numeric Discord ID. |