My app returns 200 but the assistant says it failed
My app returns 200 but the assistant says it failed
Cause: Your response body is not in the expected format.Fix: Ensure you return
{ "result": ... } at the top level:Webhook signature verification always fails
Webhook signature verification always fails
Possible causes:
- Wrong secret — confirm you’re using the
orc_*secret for lifecycle webhooks andwhs_*for outgoing events - Pretty-printed body — signature is computed over the raw bytes of the request body, not a re-serialized version
- Middleware modifying the body before it reaches your handler
- Parse the raw body bytes before JSON-decoding for signature verification
- Use
hmac.compare_digestnot== - Log both the provided and expected signatures (hex) during debugging
OAuth installation completes but tokens aren't being refreshed
OAuth installation completes but tokens aren't being refreshed
Cause: Your OAuth provider requires Without
access_type: offline or a specific parameter to return a refresh token.Fix for Google:prompt: consent, Google only returns a refresh token on the first authorization. If the user has already authorized, subsequent installs won’t include a refresh token.X-Orceum-Installation-Id is not reaching my handler
X-Orceum-Installation-Id is not reaching my handler
Cause: Header parsing issue — header names are lowercased in HTTP/2.Fix (FastAPI):FastAPI converts
X-Orceum-Installation-Id → x_orceum_installation_id automatically.My MCP tools are not being discovered
My MCP tools are not being discovered
Possible causes:
- Server not publicly reachable at
mcp_server_url - Wrong
transporttype specified (STREAMABLE_HTTPvsSSE) - Using
OAUTHauth — tool discovery happens after the first user installs
- Test your MCP endpoint directly with an MCP client
- Try clicking Refresh Tools in the Developer Studio
- Check that your server returns a valid tool list on
list_tools()
Actions are being called but the wrong user's data is returned
Actions are being called but the wrong user's data is returned
Cause: Not using Never use a global or shared account. Each installation is a separate user.
X-Orceum-Installation-Id to scope the operation.Fix: Every action must look up the correct user by installation_id:The assistant ignores my app even for obvious queries
The assistant ignores my app even for obvious queries
Cause: Action descriptions are too vague or don’t include trigger phrases.Fix: Rewrite descriptions to include when to use the action:Make sure your app’s description is clear and properly describes when users should use the app.
Installation completes with next_action: NONE but no INSTALLED webhook received
Installation completes with next_action: NONE but no INSTALLED webhook received
Cause: Your
installation_webhook_url is unreachable, or the URL is misconfigured.Fix:- Confirm
config.installation_webhook_urlis set and HTTPS - Check your server logs for incoming POSTs
- Use
ngrokor similar during local development to expose your server
Getting 401 on action calls despite a valid API key
Getting 401 on action calls despite a valid API key
Cause (most common): Your server is validating the This produces:
Authorization header, but your auth_config is using a different header name.Fix: Check your auth_config:Authorization: Bearer <key>. If your server expects X-API-Key: <key>, update auth_header_key to X-API-Key and clear authentication_scheme.Orceum times out before my action completes
Orceum times out before my action completes
Cause: Your action is processing synchronously and takes >30 seconds.Fix: Return immediately with a job reference, process async, push a webhook when done:
Pushed a webhook event but action_taken is IGNORED
Pushed a webhook event but action_taken is IGNORED
Cause: The event was filtered by Orceum’s bouncer (priority too low, quiet hours, or user preferences).Fix:
- Increase the
priorityfield:highorcriticalare harder to ignore - Ensure
events_enabled: trueinwebhook_config - Verify the
installation_idis correct and the installation isACTIVE
Quick Diagnostics
You can perform quick health checks on your app directly from the Orceum Developer Studio:- View real-time installation and active user counts in the Analytics tab.
- Click Test Webhook to verify your event endpoint is reachable.
- Click Refresh Tools (for MCP apps) to force a manifest regeneration.
Getting Help
If you’re still stuck after checking the above:- Check the Security page for signature verification examples
- Review the Error Handling page for status code behavior
- Open an issue in the Orceum GitHub repo
- Join the Discord community