Mismatch Troubleshooting

CREDENTIAL_ENV_MISMATCH

Cause: The credential you're authenticated with belongs to one environment but you're trying to act on a different environment (e.g. publishing a build with a staging token against --channel production).

Fix (CLI):

emofy use production
emofy publish --channel production

Fix (CI): ensure EMOFY_TOKEN points at the credential minted for the target channel — see cli-usage.

Response body:

{
  "code": "CREDENTIAL_ENV_MISMATCH",
  "credentialEnv": "staging",
  "channel": "production",
  "hint": "Upgrade CLI to v2 (pnpm install -g @emofy/cli@latest) and run 'emofy use <env>' for the target channel."
}

CREDENTIAL_ALREADY_EXISTS

Cause: You called POST /credentials for an env that already has an active credential. Each (app, environment) tuple is unique.

Fix: reuse the existing credential. The response body includes its id and clientId so you can locate it:

{ "code": "CREDENTIAL_ALREADY_EXISTS", "id": "apc_...", "clientId": "cid_..." }

If you need to replace the existing secret, use the rotate endpoint instead of creating a new row:

POST /api/developer/apps/:appId/credentials/:environment/rotate-secret

UNLIMITED_REQUIRES_OVERRIDE

Cause: A super-admin attempted to set tier=unlimited without override=true. The guardrail prevents accidental quota removal.

Fix: re-issue the PATCH with { tier: "unlimited", override: true, reason: "…" }. A reason is required; it's captured in app_installation_events for audit.

INVALID_CIDR

Cause: The IP allowlist update included one or more CIDR entries that failed format validation.

Fix: check the response body's invalid: [...] list. Common errors: missing /prefix, octets > 255, IPv6 without a supported prefix length (0–128).

CREDENTIAL_NOT_FOUND

Cause: PATCH / rotate was called against an env that has no credential row yet.

Fix: create the credential first:

POST /api/developer/apps/:appId/credentials
{ "environment": "staging", "inheritFromDev": true }

Or use the CLI:

emofy login --env staging