"Complete onboarding first"
You're signed in but have no agent yet. Run the scoping wizard.
Policy generation fails
Without ANTHROPIC_API_KEY you'll get the template version instead — that's expected, not an error. If a key is set and generation fails, the error text is shown verbatim; it's usually an invalid key or exhausted credit.
A policy won't appear on my trust page
It isn't approved. Generating creates a draft; drafts are excluded from the trust page, your score, and citations. Click Approve & sign.
Evidence ingest returns 401
Either the x-veriflow-api-key header is missing, or the key is wrong. Copy it fresh from the Evidence page. Repeated bad-key attempts are rate-limited to 5 per hour per IP.
Evidence ingest returns 400
Your JSON didn't contain a recognisable results array. Veriflow accepts { "results": [...] } or { "tests": [...] }. See Connect evidence from CI.
My run went to the wrong agent
Runs route by the agent field, matched case-insensitively against agent names. If it doesn't match, the run lands on your first agent. Make the field exactly match the agent name.
Tests passed but the control still shows a gap
Evidence and status are separate. Evidence badges reflect test results; the status is what you set. Set it to implemented once it genuinely is.
Trust page 404s
Three possible causes: the page is toggled off, onboarding isn't complete, or the slug is wrong. Copy the link from Trust center.
Live Q&A says "that one needs a human"
Confidence was too low to answer safely, so it fell back to the contact form rather than guessing. Add a verified answer covering that topic to your bank and it'll answer next time.
Rate limited (429)
Public endpoints are throttled to protect your API spend: trust-page Q&A at 10/minute and 60/hour per IP, contact form at 5/hour. Normal use won't hit these.
For self-hosted deployments
Every data page returns 500, "Unable to open the database file"
DATABASE_URL isn't pointing at Postgres. Serverless platforms have no writable filesystem, so SQLite can't work there. Connect a Postgres database and make sure the variable is actually set on the project — and remember to connect the database to the project, not just create it.
Google sign-in redirects to localhost
NEXTAUTH_URL is wrong. On Vercel, Veriflow self-corrects this from the platform domain and logs a warning, but the cleanest fix is setting the variable to your real domain. Verify with /api/auth/providers — the callbackUrl must show your domain.
Google returns redirect_uri_mismatch
Add https://your-domain/api/auth/callback/google to your OAuth client's authorized redirect URIs.
Nobody gets notified about contact requests
Set RESEND_API_KEY and NOTIFY_EMAIL. Without them, notifications log to the server console — which nobody reads, while your trust page promises a 48-hour response.