Installation workflow
When Install or upgrade LancerLogin or Refresh web update credential stops, the run's summary shows an error annotation whose title is one of these codes. Most checks run before anything is created or changed.
| Error code | What it means | What to do |
|---|---|---|
private_repository_required | The repository is public, or the update tokens do not belong to this private repository. | Make the repository private, or create a private repository from the template. See Create your private repository. |
operation_invalid, release_selection_invalid | An input is not one of the offered choices. | Choose create, resume, or upgrade, keep latest stable, and run again. |
installation_slug_invalid | The slug does not match the naming rule. | Use 3 to 41 lowercase letters, digits, or hyphens, starting with a letter. |
setup_code_required, setup_code_too_short | LANCERLOGIN_SETUP_CODE is missing or shorter than 16 characters. | Add or replace the production environment secret with a longer password-manager value. |
cloudflare_token_required | CLOUDFLARE_API_TOKEN is not set. | Create an account API token and store it as a production environment secret. See Create the Cloudflare API token. |
account_token_required | The token is a user API token from My Profile. Account API tokens start with cfat_. | Create the token under Manage account › Account API tokens and replace the secret. |
account_token_invalid, cloudflare_token_rejected | The token has expired, was revoked, or does not belong to CLOUDFLARE_ACCOUNT_ID. | Create a new account API token in the right account and replace the secret. |
cloudflare_account_id_invalid | CLOUDFLARE_ACCOUNT_ID is not a 32-character account ID; often it is a zone ID. | Copy the account ID again (step 4) and replace the secret. |
cloudflare_permission_missing | The token lacks one of the four permissions. The message names it. | Edit the token in Cloudflare to add the named permission, then run again. |
cloudflare_request_failed | Cloudflare did not answer a read-only check. | Check both Cloudflare secrets and run again. |
workers_subdomain_required | The account has no workers.dev subdomain, so the API Worker would have no address. | In Cloudflare, open Workers & Pages, set the account's workers.dev subdomain, and run again. |
pages_address_taken | Another Cloudflare account already uses <slug>-dashboard.pages.dev, so Cloudflare gave the project a different address. | Delete the <slug>-dashboard Pages project in your account if the run created it, then run create with a different slug. |
pages_project_unavailable | Cloudflare did not return the Pages project. | Run again with resume and the same slug. |
installation_resources_exist | create found resources for this slug already in the account. | Use resume to finish an interrupted installation, upgrade for an existing one, or another slug. |
installation_not_found | resume found nothing for this slug. | Check the slug, or run create. |
installation_incomplete | upgrade found the installation unfinished or missing resources. | Run resume with the same slug to finish setup, then upgrade. |
installation_database_missing | The Worker exists but its D1 database was not found. A new, empty database is never created for an existing Worker. | Check LANCERLOGIN_DATABASE_NAME if you set it, and the slug. |
release_invalid, release_identity_mismatch | The latest release could not be verified. | Run again later. |
dispatch_credential_required, dispatch_credential_access_denied, dispatch_credential_rejected | Refresh web update credential found LANCERLOGIN_WEB_UPDATE_TOKEN missing, without access to this repository, or expired or revoked. | Create the token again as in Set up one-click updates, replace the secret, and run Refresh web update credential. |
selection_credential_must_be_distinct, selection_credential_access_denied, selection_credential_rejected | The optional plugin management token is the same as the update token, cannot read main, or has expired. | Create a separate token with Contents: Read and write on only this repository and replace LANCERLOGIN_MODULE_SELECTION_TOKEN. |
reviewed_workflow_required | .github/workflows/upgrade-web.yml is missing or disabled. | Restore and enable it on main. |
fixed_account_resources_required, installation_slug_required | The installation variables are not set. | Add LANCERLOGIN_INSTALLATION_SLUG, LANCERLOGIN_DATABASE_ID, and LANCERLOGIN_API_URL from the run summary. See Save the installation variables. |
database_identity_mismatch, worker_database_mismatch, credential_target_unavailable | The variables do not match this installation's database and Worker. | Copy the values from the installation run summary again. |
credential_upload_failed | Cloudflare did not accept the Worker secrets. | Check that the Cloudflare token has Workers Scripts: Edit, then run again. |
token_expiration_unreadable | GitHub reported a token expiry in an unexpected format. | Run again later, and report it if it persists. |
If a run stopped partway through for another reason, run the workflow again with operation resume and the same slug. Do not use create again.
First sign-in and access
| What you see | What to do |
|---|---|
| The setup code is not accepted. | Copy the LANCERLOGIN_SETUP_CODE value again without extra spaces. To use a new code, update the secret and run the workflow with operation resume. This works only while no Admin exists. |
| Google sign-in reports a redirect mismatch. | Copy the callback address from LancerLogin into the Google client's Authorized redirect URIs exactly. See Google sign-in. |
| An account is locked after wrong passwords. | Wait 15 minutes, or have another Admin set a new password in Settings › Access. |
| No Admin can sign in. | Follow Recover access. |
| The dashboard shows Setup service unavailable or Session check unavailable. | LancerLogin could not reach its server, or the server took longer than 15 seconds to answer. Check your connection and choose Try again. |
| A page says Page unavailable. | The page does not exist or your role cannot open it. Sign in with an account that has access, or ask an Admin to assign you to that module. |
Kiosks
| What you see | What to do |
|---|---|
The phone cannot open http://<pi-hostname>.local:8788. | Make sure the phone is on the same network as the Pi. Use the IP address the installer printed instead. On the Pi, hostname -I shows it. |
| Pairing says the key expired or the setup code is wrong. | Create a new pairing key; each is valid for ten minutes. Enter the six-digit code currently shown on the kiosk screen. After five wrong codes the kiosk shows a new one and pauses pairing for a minute. |
| The attendance screen is closed. | Open the LancerLogin Kiosk shortcut on the Pi desktop. |
| The kiosk shows offline or scans are waiting. | Check the Pi's network with the network dot. Scans stay in the queue and send when the connection returns. Try Reload display, then Restart software, from Kiosks › Manage kiosk › Device maintenance. |
| Attendance is paused and the kiosk asks for the time. | The Pi has no trusted clock. Choose Open maintenance, enter the PIN, and confirm the date and time. |
| A fingerprint is not recognized. | Check that the member is active and enrolled on this kiosk. Without fingerprint sharing, enroll the member on each fingerprint kiosk. Test the reader in Authentication maintenance. |
| A kiosk update shows no result. | Check the kiosk's status before trying again. If the new release failed to start, the kiosk has already switched back to the previous release. |
| Nobody knows the kiosk PIN. | An Admin can choose Reset network PIN for that kiosk. The next person at the kiosk creates a new PIN. |
For problems the dashboard commands cannot fix, someone with access to the Pi (in person, over SSH, or with Raspberry Pi Connect) can check the service:
systemctl status lancerlogin-kiosk.service --no-pager
journalctl -u lancerlogin-kiosk.service -n 30 --no-pager
curl http://127.0.0.1:8788/healthKeep this output private. Do not delete anything under /var/lib/lancerlogin, copy a queue to another kiosk, or pair a working kiosk again: waiting scans could be lost or counted twice. The kiosk reference covers recovery in more detail.
Dashboard updates
| What you see | What to do |
|---|---|
| Updates cannot start because the update token is missing, expired, or revoked. | Create a new token and run Refresh web update credential. See Set up one-click updates. You can also update without the token. |
| The update waits for approval. | Choose Review approval in GitHub and approve the production deployment. |
| The update stops because a module moved into a plugin. | Follow the choices on Settings › Updates to keep the module by adding its plugin, or to turn it off. |
| The update failed before it changed anything. | Read the reason on the card, fix it, and start the update again with a new backup. |
A re-run of the update's GitHub workflow run fails with request_not_claimable. | Re-running a run never retries an update, and nothing was changed. Start the update again from the dashboard, or choose Apply changes for a plugin change. |
| The card says recovery is required. | Stop. Do not start another update and do not restore a backup. Open Diagnostics and manual recovery for the workflow run and contact support with what it shows. |
| A notice asks you to reload. | The installation was updated. Choose Reload updated dashboard. |
Integrations
An integration failure never undoes a meeting or attendance change, and it never stops kiosk scans. Open the integration's card in Settings › Integrations, read the reason it gives, correct the setting, and retry only that step. Changing a saved credential clears its verification until you verify again.
Backups and restores
- A restore refuses a file from another category. Restore it on the matching card in Settings › Data.
- A restore refuses a backup that contains a plugin this installation does not have. Add the plugin first, or confirm a restore that discards that plugin's data.
- A large restore can fail with a message about database limits. Restore one category at a time, or use the D1 restore commands in the backup and restore reference.
- After an entire-installation restore, pair every kiosk again.
Get help
Email robolancers@gmail.com. Support is best-effort with no response-time commitment. Describe the symptom, the page or workflow, and the release shown in Settings › Updates. Do not send tokens, passwords, backups, fingerprints, or attendance records.