Skip to main content
For sandbox connection troubleshooting, inspect the machine before changing forwarding or retrying work:
Wait for readiness. If a persistent machine is paused, check available credit and resume it through its lifecycle controls. See Pause and resume.

​
An application URL refuses access

Machine application URLs require authentication. A hostname alone does not grant access. Use the CLI’s authenticated localhost forwarding:
For an explicit local port:
Keep forwarding running and use the printed localhost URL. Check that the application is listening on the requested port inside the guest. See Forward ports. Worktree preview access ends at expiry, revocation, pause, or machine deletion. The service must be running on the bound application port. Existing streams close within the current authorization window; reconnect the browser after restoring access. Create or revoke preview links through Share a dev preview. Keep fragment tokens private.

​
Desktop access fails

A desktop grant has its own scope and lifetime. An application preview does not grant desktop access. Create a fresh authorized watch or invitation link through Watch and human takeover and check the current machine state.

​
A connection drops after pause or restore

External TCP peers may disconnect across pause. Applications and long-lived WebSockets must reconnect. Recover an uncertain command by its execution ID before deciding whether to run it again.

​
Machines cannot reach each other

Private networking reachability depends on placement. Inspect the returned network information rather than assuming every machine pair can communicate. See Private machine networking. For broader outages, read Service status.