Skip to main content
Either the OpenRouter key or the Vercel Sandbox credentials are missing. Both are required and both live in server settings. The message names which one.
The OpenRouter key is a provisioning or management key rather than an inference key. It mints other keys; it cannot answer. Mint a plain one at openrouter.ai/settings/keys.
Two ceilings exist and only one is yours. A message naming a dollar figure is the per-team cap in server settings. A raw 403 Key limit exceeded (total limit) mid-run is OpenRouter’s own limit on the key itself, and no setting here will move it. Raise it at the provider.Note that this also takes embeddings down with it, so search degrades across the whole install at the same time.
The auth layer builds its base URL from the host the request arrived on, and only trusts the one in CRAFTSPACE_URL plus anything in TRUSTED_HOSTS. Check that your proxy forwards X-Forwarded-Proto and X-Forwarded-Host.
With no RESEND_API_KEY, the sign-in code is written to the server log instead of being emailed. The screen says so. Read it out of the log, or configure email.
They check the URL before accepting it, and neither will accept localhost over plain http. Give the install a public address, then register the callbacks against it.
Every install runs the connection gateway in-process on loopback, and it is not optional. If it fails to bind, every connection path goes with it: listing tools, calling them, the OAuth dance and source fetches. Check the boot log.
Page writes index into search after the row is written, and an indexing failure is logged rather than raised. If saves are failing outright, it is not the embedding provider.

​
Reading the log

Logs are wide events, one JSON object per request, with redaction always on. Grep for the event field: recorder.disabled, install_credential.saved, broker_identity.refused and friends each name exactly one thing that happened.