CLI troubleshooting

Run the failing command again with --json to get the exact error message as data, and check restward whoami to see the session the CLI is using.

Authentication

Not logged in. Run: restward login --base-url <url> There is no stored session: you never logged in, you logged out, or RESTWARD_CONFIG points at a different file than before. Run restward login.

Session expired — run 'restward login'. The CLI renews sessions automatically, so this means renewal was not possible: the refresh token expired (7 days with the platform's default settings), it was revoked (by restward logout of this session, restward logout --everywhere on any machine, or because the platform saw an already used refresh token presented again - for example from a copied config file - and ended the whole session), or the session was stored with login --token, which cannot be renewed. Log in again.

The platform rejected RESTWARD_TOKEN (expired or revoked) RESTWARD_TOKEN is set, so the CLI uses it instead of the stored session, and it is no longer valid. Tokens from the environment are never renewed: provide a fresh one, or unset the variable to use the stored session.

RESTWARD_ORG must be an organization id (GUID). RESTWARD_ORG only accepts the organization's ID. Copy it from the dashboard's Settings page (or use restward org use <slug> for a stored session).

Login failed: Too many failed sign-in attempts for this account. Try again in N seconds. The CLI remembers this machine as a trusted device after a successful sign-in (the deviceToken in ~/.config/restward/config.json, a secret like the tokens). Failed attempts from a trusted machine count only for that machine: after several wrong passwords it waits, and the wait grows each time. A machine that has not signed in before (or after 90 days without use, or after logout removed the config) shares the account's budget for new devices: if many wrong passwords were tried, it waits until the current window ends (the time shown, at most 30 minutes). Wait the time shown, then sign in with the right password. Too many requests. means too many attempts from your address in a short time.

Login failed: ... after entering credentials Check the email and password against the dashboard login, and that --base-url (or RESTWARD_API_URL) is the platform API address, e.g. https://api.restward.tech, not the dashboard or marketing site.

Login failed: --email is required (or run interactively). / Login failed: no password. The CLI is not running in a terminal, so it cannot prompt. Pass --email, and pipe the password with --password-stdin or set RESTWARD_PASSWORD; see Using the CLI in CI.

--password was removed: ... The password can no longer be passed as an argument (other processes can read command lines). Use --password-stdin or RESTWARD_PASSWORD instead.

A corrupt or hand-edited config file If the config file cannot be read, the CLI behaves as if you were logged out. Running restward login overwrites it.

Organization selection

No organization selected. Run: restward org use <orgId|slug> (see 'restward whoami') Your session is not scoped to an organization. Select one with restward org use <orgId|slug>, using the organization's ID (a GUID) or slug from the dashboard's Settings page.

No organization with slug '…' among your organizations (…) The slug is not one of your organizations; the message lists the slugs you can use.

Could not switch to organization …: This organization requires single sign-on. … The organization requires single sign-on, and your session signed in with a password. Sign in to that organization with SSO in the dashboard; the CLI cannot sign in with SSO yet.

Could not switch to organization …: This session can no longer be renewed or switched. Please sign in again. The session dates from before the platform recorded how sessions sign in. Run restward login again.

Could not switch to organization …: You do not have active membership in this organization. You are not an active member of that organization; restward org list shows your memberships and their status.

Commands act on the wrong organization restward whoami shows the selected organization. Switch with restward org use <orgId|slug>. Logging in again selects the organization of the new session.

Connecting databases

Cannot infer the database provider. A key=value connection string without a Provider= key or SQL Server-style keys. Add --provider postgreSql, --provider MySql, --provider oracle, --provider db2 or --provider sqlServer.

Unsupported connection string scheme Only postgresql://, postgres://, mysql://, oracle://, db2://, mssql:// and sqlserver:// URIs are accepted. See Connect a database.

Connection test failed: ... The platform could not reach or log in to your database. Check that the host is reachable from RestWard (not just from your machine), the firewall allows RestWard, the credentials are right, and the SSL setting matches the server (--no-ssl for a server without TLS). The connection was created without an API: delete it in the dashboard or retry with another name.

Provisioning did not finish within 120s Provisioning is still running or stuck. Check the API's status with restward list or in the dashboard. For large schemas, allow more time with --timeout 300.

I lost the API key Keys are shown once, at creation, and only a hash is stored. Create a new key in the dashboard under Auth & Keys; restward keys lists existing keys by prefix.

Network, proxies and TLS

Request timed out — check the platform base URL and your network. Each request to the platform times out after 30 seconds. Check the base URL and that you can reach it, e.g. curl -sI https://api.restward.tech/health.

Behind an HTTP proxy The CLI uses the standard proxy environment variables:

export HTTPS_PROXY=http://proxy.internal:3128
export NO_PROXY=localhost,127.0.0.1

On Windows and macOS it also uses the system proxy settings when these are not set.

TLS or certificate errors (Network error: The SSL connection could not be established) The CLI validates the platform's certificate against the operating system's trust store, and there is no option to skip validation. Behind a TLS-inspecting proxy, install the proxy's CA certificate into the OS trust store (on Linux, the OpenSSL CA bundle; setting SSL_CERT_FILE to a bundle that includes it also works).

Exit codes and options

Unknown option '--foo', Missing required argument and an unknown command are usage errors and exit with code 2; other failures (for example not being logged in) exit with 1. restward <command> --help lists a command's options.