Troubleshoot setup

For problems people hit in a group, such as no reply, error replies or approvals, see Troubleshooting. This page covers setup.

Start a fresh sign-in from the live site's configured public domain. Sign-in redirects alternate deployment URLs there before setting its state cookie. Finish in the same browser within ten minutes; starting another sign-in replaces the earlier attempt. The Google client's callback must match the configured public URL, including www when used.

The API key is rejected

Check and save tests the key against Anthropic before storing it. Make sure it's a current key for the Anthropic organization you want billed, and that the organization has access to Managed Agents.

Nobody got the "Should Cloud join" email

There was no welcome message. Google sends its "You have been added" notice only when the person adding the agent typed a welcome message. Post @cloud connect (or mention @cloud) in the group, and your Owners and Admins get the email. An Owner or Admin can also click Turn it on now on the group's Overview.
The mailbox was invited, not added. Invitations need a click in a browser. Your Owners and Admins get an email explaining how to add it directly: in Google Groups, Members → Add members, turn on Directly add members, and add the address.
The group is on a domain the mailbox can't join. Your Owners and Admins get an email titled "Cloud can't join …" explaining why. A Workspace mailbox joins only its own domain's groups; a personal Gmail mailbox joins only public googlegroups.com groups. The organization page also shows "Kept out of …" under the agent for a week.
Several agents in one group. Each agent added to a group, in your organization or another, gets its own copy of the group to turn on, and agents never answer each other's posts there.
The mailbox isn't being read. On the organization page, check the agent's last read time. If it shows link again, Google revoked its access: click Link again and sign in as the mailbox.
The group already has the agent. If the group was turned on before, re-adding the mailbox needs no new answer.
The link expired. Join links last 14 days. Post @cloud connect for a new one.

Mail is ignored

The agent believes group mail only when Gmail's Authentication-Results shows a passing DKIM signature from the group's own domain, and that signature covers the message's List-Id (Google Groups signs it on every delivery). SPF alone isn't enough, and neither is a signature from a member's own mail. Otherwise anyone could forge mail "from" the group. When group mail is ignored, the organization page shows "Ignored mail from …" under the agent for a week, with which domains signed it.

Google Workspace groups: turn on DKIM signing for your domain in the Google Admin console (Apps → Google Workspace → Gmail → Authenticate email), then post again.
Public googlegroups.com groups: Google signs these itself; if mail is still ignored, check that the message really came through the group rather than as a direct copy.
"Ignored a message for … sent straight to" the agent: someone put the agent's own address in To or Cc. Gmail keeps only the first copy of a message, so the agent's mailbox got that direct copy, and discarded the group's signed one. The agent accepts a direct copy only when Gmail confirmed the sender (DMARC) and the sender has posted through the group before. Mail between two users of the same Workspace domain may carry no confirmation at all. Ask people to send to the group. To make that the default, set the group's replies to go to the group in Google Groups: Reply then addresses the group instead of the agent.

The agent didn't answer someone

Only the group's members get answers.

If Google doesn't list the person as a member, the group's admins got an email about it. Allow them on the group's Admins page.
If the organization page says the agent can't read Google's member lists, Link again as the agent's mailbox and allow it.
If Gmail couldn't verify who sent the post, they don't count: their domain needs DKIM signing turned on, or a DMARC record (v=DMARC1; p=none is enough).

The agent replies but can't use a connector

Open the group's Connectors page. A connector with an error shows its last error.
For an OAuth connector, click Reconnect account. The account's token may have expired or been revoked.
Check the connector's permissions: a tool set to disabled, or not enabled under Only the tools enabled below, can't be called.
If calls are waiting, they're on the Approvals page.

The agent can't reach a website

The group's network mode may be limited or off. On Network & secrets, choose Full internet access, or add the host to the allowed list. Connectors work in every mode.

A secret isn't being used

The real value is sent only on requests to the hosts listed for it. Check the host list matches the API's hostname exactly, and that the code uses the variable name you gave it. Secrets don't work when network access is No internet.

Replies stopped for the whole organization

Check Spend limits on the organization page. When the organization's monthly limit is reached, every agent stops answering. Also check the Anthropic account behind the API key for billing problems: agents say "the Anthropic account I run on has a billing problem" when it has one.

Replies are slow

Without an Anthropic webhook, a long reply is picked up by a poll once a minute after the first few minutes. Add the webhook described in Set up Cloud Tag.

A routine turned itself off

A routine that fails three times in a row is turned off. The group's Usage & activity page shows each failed run's error under Recent turns. Fix the cause, then Resume it on the Routines page.

A thread is paused for input review

An interrupted submission may already have run even when its response was lost. Cloud Tag pauses the thread rather than sending that request again. New mail is still stored. Older active attempts without an exact input record also need review after this upgrade.

Open the thread on History. An admin can copy its earlier session ID and find it in the linked Sessions console. Inspect the requests and actions there first. If the attempt is still settling, wait for it to stop; if sealing is blocked by provider work, resolve that work in the provider console. Cloud Tag keeps the thread paused until it can finish safely.

Select only pending messages already handled and choose Mark selected handled. This keeps the thread paused while you work through its pages. When ready, confirm the review and choose Resume unhandled requests. That starts a fresh session; unselected messages on every page and new mail can run, so earlier actions may be repeated if you leave their requests unhandled. A stale form is refused—reload if another admin changed the review.

Restart session and unmuting do not clear input review. A private DM's participant reviews it; an organization Owner cannot review someone else's private DM.

Sending limits

The agent sends through its Gmail mailbox, so Gmail's daily sending limits apply: about 500 messages a day for a gmail.com account and about 2,000 for a Google Workspace mailbox.