Troubleshooting

This page lists the CLI’s common error messages, with the cause and fix for each. Find the message you saw. Placeholders such as <id> stand for your values. If you’re not sure where to start, run droneship whoami: it shows the profile, project and deployment you’re using.

Signing in

Not signed in

not logged in for profile 'default' — run `droneship login`

Cause. This profile has no stored login on this machine.

Fix. Run the command it names. For another profile it names that profile, for example droneship --profile work login. Check DRONESHIP_PROFILE if you didn’t expect that profile. See Sign in and use profiles.

Credentials rejected

credentials rejected — run `droneship login`

Cause. The service refused your token, and a refresh didn’t fix it. An expired session with no refresh token says session expired and no refresh token instead.

Fix. Sign in again with droneship login.

Wrong deployment

You previously authenticated with https://api.highflame.ai, but the API endpoint is now https://<api-host>. Unset the override to keep using https://api.highflame.ai, or sign in to the new endpoint under another profile: `droneship --profile <name> login`.

Cause. DRONESHIP_API_URL or DRONESHIP_AUTH_URL points somewhere other than where this profile signed in. The CLI sends a token only to the deployment that issued it, so it stops before sending a request.

Fix. Unset the variable to keep using this profile’s deployment. To use the other deployment too, sign in to it under a second profile, for example droneship --profile staging login. See Environment variables.

Profile signed in to another deployment

Profile 'default' is signed in to https://api.highflame.ai (sign-in https://auth.highflame.ai).
This login would move it to https://<api-host> (sign-in https://<auth-host>).
Use another profile for the new deployment: droneship --profile <name> login --api-url https://<api-host> --auth-url https://<auth-host>
Or pass --force to replace this profile's login.

Cause. You ran droneship login with a different --api-url or --auth-url (or the matching environment variable) on a profile that is already signed in to another deployment. login doesn’t move a signed-in profile, so it stopped and kept the old login.

Fix. Run the command it prints, with a profile name of your choice, to keep both logins. If you passed only --api-url, the command shows --auth-url <sign-in url>: replace it with the new deployment’s sign-in address. To replace this profile’s login instead, run your login again with --force, and pass both --api-url and --auth-url. droneship run prints endpoint: <url> (profile: <name>) so you can check which one a command uses. See Sign in and use profiles.

Plaintext endpoint

Refusing to talk to http://<host> over plaintext. Every request carries your bearer token, and a create response carries the sandbox's private SSH key — use https:// (or a localhost dev server).

Cause. The endpoint, from the profile or DRONESHIP_API_URL, uses http:// on a host other than your own machine.

Fix. Use the https:// address. Plain http:// works only for localhost.

Launching

Saved workspace in use

This saved workspace is in use by <id>.
  Join it:              droneship run claude --id <id>
  Or work separately:   droneship run claude --ephemeral  (a scratch sandbox; nothing is saved)

Cause. Your saved workspace for this repo holds one sandbox at a time, and another sandbox has it. This is what plain --new hits on a repo you’re already working in.

Fix. Join the running sandbox with --id, or start a separate scratch one with droneship run claude --new --ephemeral. See Run agents in parallel.

Private repo not connected

'https://github.com/<owner>/<repo>' was not found, or it is private and you have not connected GitHub yet.
Authorizing GitHub… a browser window will open.

Cause. The repo is private and your GitHub account isn’t connected yet (or the repo doesn’t exist at that address).

Fix. Approve the request in the browser window. The CLI then retries the launch. If the CLI then says GitHub authorized — but the Highflame Forge app is not installed on any account yet., install the app from the link it prints and run the same command again. See Work on a private repo.

More than one matching sandbox

You have more than one matching sandbox:
  <id>  <repo>  <time>
  <id>  <repo>  <time>

Name the one you want, e.g. droneship run claude --id <id>

Cause. You have more than one sandbox for this repo, and the CLI doesn’t choose one for you.

Fix. Pick one from the list and pass --id. droneship list shows them all.

Key not set

ANTHROPIC_API_KEY is not set in your environment.

Cause. --byok names a variable, and that variable isn’t set in this shell (or it’s set but empty).

Fix. Export the key, then launch again. --no-byok forgets a remembered key name.

export ANTHROPIC_API_KEY=sk-ant-...
droneship run claude --byok ANTHROPIC_API_KEY

The agent’s model calls fail with “brokered credentials”

API Error: 403 brokered credentials belong to a person, and this caller is a workload acting as itself with no person in its delegation chain

Cause. Your project also uses the Highflame AI Gateway, and its Anthropic provider is set to brokered: the gateway holds the credential itself. The gateway then ignores the key or plan that the sandbox sends, and it does not give a person’s credential to a sandbox. This happens with --byok and with --subscription.

Fix. Do 1 of these:

• Add --direct, with your key or your plan, so that the model calls skip the gateway. The calls then skip gateway policy and spend metering too.

  droneship run claude --new --direct --subscription

• Ask an admin of your organization to set the project’s Anthropic provider to byok in Studio, under AI Gateway → LLM Providers. This also stops brokered access for the project’s other users of that provider.

Plan limits

Both come back from the control plane when you launch, resume or restore a sandbox. On Trial, the message says Trial instead of Free. See Limits.

Too many sandboxes running

Free plan limit reached: 5 concurrent sandboxes. Contact sales@highflame.com to switch to Pro.

Cause. Your organization already has as many live sandboxes as the plan allows. Interactive sessions and running prompt runs from everyone in the organization count.

Fix. Stop one you no longer need, then launch again. Teammates’ sandboxes count too, so ask them to stop theirs if yours are all in use. To run more at once, contact sales@highflame.com to switch to Pro.

droneship list
droneship kill <id>

Monthly sandbox hours used up

Free plan limit reached: 30 sandbox hours this month. Contact sales@highflame.com to switch to Pro.

Cause. Sandboxes in your project have run for the plan’s hours since the first of the month (UTC), counting stopped ones and the time so far of running ones.

Fix. The hours reset on the first of next month. To keep launching before then, contact sales@highflame.com to switch to Pro. A sandbox that’s already running isn’t stopped.

Prompt runs

Prompt run with your own plan

Invalid value for --prompt with --subscription: a plan login needs a person in the sandbox, and a prompt run has none. Set your provider key (for example ANTHROPIC_API_KEY), or export a `claude setup-token` token as CLAUDE_CODE_OAUTH_TOKEN, instead

Cause. Signing in to your Claude plan needs a person in the sandbox, and a prompt run has none.

Fix. Drop --subscription. Export ANTHROPIC_API_KEY, or, to bill your plan, run claude setup-token and export the token it prints as CLAUDE_CODE_OAUTH_TOKEN. A prompt run sends either with no flag.

Prompt run with no key

No ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN is set. Nothing was started.
  For your subscription plan: run claude setup-token and export the token as CLAUDE_CODE_OAUTH_TOKEN.

Cause. A prompt run needs your API key or your plan’s token. Neither is exported or named with --byok, and you have no key saved in the console.

Fix. Export ANTHROPIC_API_KEY, or run claude setup-token and export the token it prints as CLAUDE_CODE_OAUTH_TOKEN. Then run the same command again. To stop exporting a key each time, save it once on the console’s Settings page, under Model keys.

Subscription token rejected

Error: your Claude subscription token was rejected: OAuth access token is invalid.

Cause. Anthropic refused the token in CLAUDE_CODE_OAUTH_TOKEN. It was revoked, it expired, or it was copied wrong.

Fix. Run claude setup-token again, export the new token, and run the same command again.

Prompt run going direct

Invalid value for --prompt with --direct: a prompt run can only reach models through the gateway. Drop --direct

Cause. A prompt run reaches models only through the gateway.

Fix. Drop --direct.

Interactive sandbox has no logs

<id> is an interactive sandbox; `logs` shows prompt runs (`droneship run claude -p …`). Open it with droneship shell --id <id>.

Cause. droneship logs reads the log of a prompt run. A live session has none.

Fix. Open the sandbox with droneship shell --id <id>, or reattach with droneship run claude.

No prompt run with that id

No prompt run named <id>. droneship list -a shows the ones you can read (stopped runs are kept 7 days).

Cause. The id is wrong, or the run stopped more than 7 days ago.

Fix. Run droneship list -a and copy the id from there. See Background runs and logs.

Version mismatches

Service too old

This control plane is too old for droneship run -p (it ignored the prompt). Terminating the sandbox.

This control plane is too old for --subscription (it ignored the request). Terminating the sandbox.

Cause. Your CLI is newer than the deployment it talks to, and the service ignored a feature it doesn’t know. The CLI stops the sandbox it started rather than leave it running in the wrong mode.

Fix. Run droneship whoami to check which deployment you’re on. On the hosted service, wait for it to catch up. On your team’s own deployment, ask whoever runs it to update.

Agent the deployment doesn’t have

Your CLI knows 'codex'; this deployment does not — they are different versions, not a failure.
  Sign in to a deployment that has it (droneship --profile <name> login --api-url <url>), or wait for the deploy.

Cause. The same version skew in the other direction: the CLI offers an agent that the service doesn’t run yet.

Fix. Use another agent for now, or sign in to a deployment that has it under another profile.

Network

Can’t reach the service

Error: could not reach https://api.highflame.ai/<path>: <reason>
Check your network. `droneship whoami` shows which deployment this profile talks to.

Cause. The CLI couldn’t connect to the service: no network, a proxy, or a profile pointed at the wrong address.

Fix. Check your connection, then droneship whoami to confirm the control plane address.

The agent can’t reach a host

A download, install or API call inside the sandbox fails with a connection reset (curl exits with code 35) or times out.

Cause. The sandbox’s egress policy doesn’t allow the host. A blocked HTTPS connection fails during the TLS handshake, and a connection on another port times out. Neither says that a policy blocked it.

Fix. Open the sandbox’s Network tab in the console to see which host was blocked, and click Allow on its row, or add an allow rule on the project’s Egress page. Running sandboxes get the rule within seconds. See Egress rules.

Still stuck

Run the command again with DRONESHIP_DEBUG=1 if the CLI printed Unexpected error, and include the traceback when you report it.

Next

• Environment variables: what each variable changes.
• FAQ: common questions.
• CLI reference: every flag on droneship run.