Question 1

Invalid webhook URL error on save

Accepted Answer

Ensure you copied the full Incoming Webhook URL from your Slack app configuration, including the https:// prefix. The URL must start with https://hooks.slack.com/services/. Do not use a Bot Token URL — webhook URLs look different.

Question 2

Cleo not responding in Slack channel after connection

Accepted Answer

After connecting, you must invite Cleo to the channel using /invite @Cleo. Cleo only responds in channels it has been explicitly invited to — it does not join automatically.

Question 3

OAuth connection fails or redirects to an error page

Question 4

Slack workspace says it's already connected to another account

Accepted Answer

Each Slack workspace can only be connected to one Arvelo account. If you need to move the connection to a different account, disconnect it from the original account first via the Chat Platform settings, then reconnect from the new account.

Question 5

"Couldn't find a Microsoft 365 tenant for this domain"

Accepted Answer

The domain is verified, but Microsoft has no tenant registered for it — double-check you entered your organisation's actual email domain (e.g. acmecorp.com), not a subdomain or an unrelated domain.

Question 6

Domain verification stuck on "pending"

Question 7

"This domain is already registered by another account"

Accepted Answer

The domain has already been connected under a different Arvelo account. Contact support@arvelo.io if you believe this is a mistake.

Question 8

Cleo not visible in Teams after connecting the domain

Question 9

Messages sent to Cleo in Teams get no response

Accepted Answer

Confirm the bot is live (the Live toggle in your dashboard must be ON). Also check the Escalation settings — if ticket creation is failing due to a misconfigured ticketing system, responses may be delayed.

Question 10

URL crawl returns 400 Bad Request

Accepted Answer

Ensure the URL includes the full protocol prefix (https:// or http://). The URL must also be publicly accessible without authentication. VPN-gated or password-protected pages cannot be crawled.

Question 11

Crawl completes but returns 0 entries

Accepted Answer

The page may be rendered entirely by JavaScript — Cleo's crawler reads static HTML only. Try exporting the page as a PDF and uploading it instead. Single-page apps and React/Vue/Angular-rendered pages often have this issue.

Question 12

Crawl only finds 1 page despite choosing depth 2 or 3

Accepted Answer

Cleo only follows links within the same domain. External links and anchor-only links (#section) are skipped. If the page's navigation links point to a different subdomain (e.g. docs.company.com vs company.com), those won't be followed.

Question 13

Confluence sync failing with 401 Unauthorized

Question 14

Confluence sync returns 0 articles

Question 15

Freshdesk KB sync returns no articles

Question 16

Zendesk sync returns no articles

Question 17

Notion sync not finding databases

Question 18

File upload fails immediately

Question 19

File uploaded successfully but no entries appear

Accepted Answer

The file may not contain enough structured content (questions and answers) for Cleo's AI to extract. Try manually adding a few Q&A pairs using the Manual FAQ editor to supplement the upload.

Question 20

403 Forbidden when testing connection

Accepted Answer

The API token must belong to an account with at least Service Management Agent or Project Admin role in the Jira project. Ensure the Project Key matches exactly (it's case-sensitive, e.g. IT not it).

Question 21

Tickets created with the wrong issue type

Accepted Answer

Leave the Issue Type field blank — Cleo will auto-detect the correct type from your project schema. If you specify it manually, it must exactly match an issue type that exists in your project (including capitalisation).

Question 22

Jira API token rejected

Question 23

Invalid API key error

Question 24

Tickets not appearing in Freshdesk

Accepted Answer

Check that the API key has Create Ticket permissions. Also verify your Freshdesk account is not in trial mode with restrictions on API-created tickets.

Question 25

401 Unauthorized on connection test

Accepted Answer

Token access must be enabled in Zendesk Admin Centre → Apps & Integrations → APIs → Zendesk API → Settings → Token access (toggle ON). The admin email must match the account that owns the API token.

Question 26

Domain not accepted

Accepted Answer

Use only your subdomain without https:// — for example yourcompany, not yourcompany.zendesk.com.

Question 27

On-Premise: connection refused or timeout

Question 28

Cloud (Zoho OAuth): redirect fails or returns an error

Question 29

Cloud: disconnect button not working

Accepted Answer

If the disconnect request fails, try refreshing the page and trying again. If the problem persists, contact support — we can revoke the OAuth token from our side.

Question 30

Escalated conversations aren't creating tickets

Accepted Answer

Check that a ticketing system is connected and the Escalation page has "Create ticket" enabled. If the ticketing connection itself is failing, see the Ticketing System Issues section above for the relevant error.

Question 31

Escalated conversations aren't sending email alerts

Accepted Answer

Verify the alert email list on the Escalation page contains valid addresses and that "Email alert" is toggled on. Check spam/junk folders — alerts are sent from no-reply@arvelo.io.

Question 32

Escalated conversations aren't posting to Slack/Teams

Accepted Answer

Confirm the channel alert toggle is enabled on the Escalation page and that your Slack or Teams connection is still active (see Connecting Your Chat Platform above). If the integration was disconnected, channel alerts will silently stop.

Question 33

No escalation method seems to be configured

Accepted Answer

If none of ticketing, email, or channel alerts are enabled, escalated conversations are dropped with no notification. The Escalation page in your dashboard shows a warning banner when this is the case — enable at least one method, ideally email as a safety net.

Question 34

Tickets are being created with the wrong priority

Accepted Answer

Cleo assigns a priority (Low, Medium, High, or Critical) based on the conversation content. You can adjust the SLA target hours for each priority level from your Settings page, but the priority assignment itself is automatic and not user-editable per ticket.

Question 35

Can't find where to edit the message employees see when escalated

Accepted Answer

Open the Escalation page in your dashboard — the customisable message shown to employees in Slack or Teams when their conversation is escalated is edited there.

Question 36

Can't see which conversations were escalated

Accepted Answer

The Activity page shows all interactions and can be filtered by status (Resolved by Cleo / Escalated), category, and date range. Escalations from the last 48 hours are highlighted at the top.

Question 37

"No account found" error after SSO redirect

Accepted Answer

Your email domain is registered for SSO but no Arvelo account exists for it. Your IT administrator needs to invite you from the Authentication section of their dashboard. If you are the admin, contact support@arvelo.io.

Question 38

Enable toggle is greyed out on a registered domain

Accepted Answer

The domain hasn't been verified yet. Expand the provider card in Access & SSO, add the TXT record shown in the "Verify domain ownership" panel with your DNS provider, then click Verify. The toggle becomes available once verification succeeds.

Question 39

"Couldn't find a TXT record yet" when clicking Verify

Question 40

"Found a TXT record, but the value doesn't match"

Accepted Answer

The TXT record exists but its value doesn't exactly match the token Arvelo issued. Re-copy the Value field from the "Verify domain ownership" panel and replace the DNS record's content with it exactly — don't reuse a token from a previous attempt.

Question 41

SSO redirect loop — keeps going back to the identity provider

Question 42

Azure AD: "This organization's Azure AD SSO isn't fully configured"

Accepted Answer

The domain isn't verified and enabled yet in Access & SSO, or one of the three required fields (Application (client) ID, Directory (tenant) ID, or Client Secret) is missing or incorrect.

Question 43

Azure AD: "Domain mismatch" error

Accepted Answer

The signed-in Microsoft account's email domain doesn't match the domain registered for Azure AD SSO in Access & SSO.

Question 44

Azure AD: SSO worked before but has stopped

Accepted Answer

Azure AD client secrets expire (commonly after 6, 12, or 24 months depending on what was set). Check the secret's expiry in Certificates & secrets in your Azure app registration, and create a new one if it has lapsed — then update it in the Azure AD card in Access & SSO.

Question 45

Okta: invalid_client error during SSO login

Question 46

Google SSO: access blocked — app not verified

Accepted Answer

If your Google Workspace organisation has restricted which third-party apps employees can authenticate to, your Google Admin needs to add Arvelo to the approved list in the Google Admin Console → Security → Access and data controls → API controls.

Question 47

Google SSO: some users can sign in but others cannot

Accepted Answer

Google does not provide per-user or per-group access control for Internal OAuth apps — all users in your Workspace org can authenticate via Google. To restrict who can access Arvelo, use the Users tab in Access & SSO to invite specific team members. Users who authenticate via Google SSO but haven't been invited will see a 'no account found' screen and cannot proceed.

Question 48

Google SSO: app not listed in Google Admin Console

Accepted Answer

Internal OAuth 2.0 apps set up in Google Cloud Console do not appear in the Google Admin Console app lists (Web and mobile apps, or Manage app access). This is expected behaviour. Access control for Arvelo is managed through Arvelo's own Users tab in Access & SSO, not through Google's Admin Console.

Question 49

Session expires too quickly

Accepted Answer

From the Authentication page in your dashboard, increase your company-wide session timeout. The default is 8 hours. Note that SSO sessions may also be limited by your identity provider's own token lifetime — check your IdP settings too.

Question 50

MFA app lost or phone changed

Accepted Answer

Contact support@arvelo.io with proof of account ownership (from your registered email address). We will verify your identity and reset your MFA.

Question 51

Invited user not receiving setup email

Question 52

"Insufficient permissions" error when connecting Azure AD

Question 53

OAuth redirect fails after authorising the Azure app

Accepted Answer

Ensure the Redirect URI in your Azure app registration matches exactly what Arvelo expects. Contact support for the exact redirect URI if you're unsure. The Agentic Actions Azure connection is a separate app registration from your SSO connection.

Question 54

Google OAuth redirect fails or returns an error after authorising

Accepted Answer

Ensure you completed the authorisation using a Google Workspace admin account — personal Google accounts cannot grant the required admin permissions. Try clearing browser cookies and reconnecting. If the error persists, contact support@arvelo.io.

Question 55

Google Workspace connected but group search returns no results

Accepted Answer

Ensure your Google Workspace admin account has the Admin SDK Directory API enabled in your Google Cloud project. Groups must exist in your Workspace directory. If groups were recently created, allow a few minutes for them to appear.

Question 56

Disconnect button not working for Google Workspace

Accepted Answer

If the disconnect request fails, refresh the page and try again. If the problem persists, contact support — we can revoke the OAuth token from our side.

Question 57

Okta API key rejected on connection

Accepted Answer

Generate the API token in Okta Admin Console → Security → API → Tokens. The token must belong to a Super Administrator account. Tokens created by non-admin accounts will be rejected.

Question 58

Okta group search returns no results

Accepted Answer

Ensure your Okta API token has read access to groups. Verify the Okta domain is entered without https:// (e.g. yourcompany.okta.com not https://yourcompany.okta.com).

Question 59

Automatic group owner detection not working for Okta

Accepted Answer

Automatic group owner detection requires Okta Identity Governance — an additional Okta licence. Without it, you can still use Okta group access by creating a custom rule with a manually set approver email for each group.

Question 60

Approval emails not arriving

Question 61

Approval link has expired

Accepted Answer

Approval links expire after the configured period (default 72 hours). The approver must ask the employee to re-submit the request, which will generate a new approval email with a fresh link. You can increase the expiry window in Agentic Actions settings.

Question 62

No approver found for a group

Question 63

Employee added to wrong group

Accepted Answer

If a custom rule is involved, verify the group selected on that rule is correct — edit it in the Agentic Actions page and use the group search to find and select the right group. If routing relied on the default owner matching, check that Cleo correctly identified the group from the employee's message. Changes take effect immediately for new requests.

Question 64

"User already in group" shown in activity log

Accepted Answer

This is informational, not an error. Cleo attempted to add the user but they were already a member of the group. The approval flow still completes and the employee is notified.

Technical Support

Still stuck?