Troubleshooting

Common problems and what to try.

Login

I cannot sign in with my passkey

Most "passkey not recognized" failures fall into one of three buckets:

  1. You are signing in from a new device that has never enrolled a passkey for this account. This is by design; subpoof does not let you bypass the passkey enrollment. Ask your org admin (or, for solo accounts, email support@subpoof.com) to send an enrollment magic link to your account email. Click the link, and the browser will prompt you to enroll a fresh passkey for the new device.

  2. Your browser does not have access to the passkey vault you enrolled with. If you enrolled in iCloud Keychain on a Mac and are now trying to sign in from a Windows machine, the keychain does not roam. Same fix: re-enroll on the new device.

  3. The Passwordless service is reporting an error. Check the dashboard's status page; if Passwordless is down, sign-ins fail across the board until it recovers.

I am stuck in a loop at /login

If clicking your magic-link enrollment URL keeps redirecting back to /login, the most common cause is a stale session cookie. Clear cookies for dashboard.subpoof.com and try the link again. Magic links are good for 7 days from when they are issued.

How do I sign out, or sign in as a different user?

The /profile page (sidebar: Profile) has a Sign out button at the bottom. That clears your session cookie and returns you to /login, where you can sign in with a different passkey. You can also reach the same logout endpoint directly at https://dashboard.subpoof.com/logout - it accepts either GET (link) or POST (form) and is the same action either way.

Scans

My scan is stuck in "running" forever

Scans normally finish in a couple of minutes for small domains and up to ~30 minutes for very large ones. If a scan has been running for more than an hour, it is probably stuck in an enrichment that timed out. Open a support ticket with the scan ID; we can re-queue it.

A scan finished but is missing subdomains I expected

Subdomain coverage depends on which discovery techniques you enabled. If you disabled TLS cert enumeration or DNS enrichment, those name sources are not surfaced. Try a fresh scan with the full default set.

If the missing subdomains are reachable but the scan never tried them, file the scan ID with support - that is feedback that improves the dictionary.

I expected an enrichment to run but the result is empty

Some enrichments only return data when the target meets a precondition (e.g. NTLM probe only fires meaningful data for hosts that respond to NTLM authentication). An empty result is not always a bug; it often means "nothing to report".

If you are confident the enrichment should have produced data and did not, file the scan ID.

Watches and alerts

I set a watch but never received an alert

Three things to check, in order:

  1. Is the watch active? Open /watches and confirm the watch row's status is "active".
  2. Is alert delivery on? The watch detail row has an alert-delivery toggle. If it is off, subpoof still records diffs but does not email.
  3. Are alerts going to spam? The autoresponder and watch alerts are sent from subpoof.com via Resend. Search your spam folder for the sender domain.

If all three check out and you are still not getting alerts, file the watch ID.

Alerts are too noisy

Watches batch alerts: at most one email per watched domain per day. If a single watch is still too noisy, the watch is probably attached to a domain with churn that does not warrant per-day notification. Either remove the watch, or tighten its filters (label watches and search watches let you scope what counts as "new").

API

I keep getting 401 unauthorized

The most common cause is a typo in the X-API-Key header value. Copy the key from /settings directly; the dashboard hides middle characters but the copy button copies the full value.

If the header is correct and you are still getting 401, the key may have been rotated. Rotation invalidates the old key immediately.

I am hitting 429 rate limits

Observer tier is 30 req/min, 2 concurrent. Analyst is 300 req/min, 10 concurrent. The 429 response includes a Retry-After header indicating seconds to wait. The Anthropic-style SDKs honor this automatically; if you are calling raw HTTP, respect the header.

If you need higher limits than Analyst provides, open a ticket - we can usually raise the per-account ceiling.

Billing

I was charged but my account is still on Observer

Stripe webhooks reflect your subscription within a minute or two of checkout completing. If your account is still showing Observer 5+ minutes after Stripe charged the card, file a ticket with the Stripe invoice number.

I see a duplicate charge

Stripe occasionally retries a transient failure and leaves both attempts visible in the dashboard. The customer portal shows you the canonical invoice list; only the rows marked "paid" actually charged your card. If you see two "paid" rows for the same period, file a ticket with both invoice numbers.

Anything else

If your problem is not on this page, open a ticket. The autoresponder will tell you which doc to read first if there is one; otherwise a human picks it up.