Troubleshooting
Find the message you are seeing in your provider’s table below. Each row gives the likely cause and the step to go back to.
Three symptoms are worth knowing before you start:
- “Uploads from the UI fail but admin diagnostics pass” is almost always a missing CORS rule on the bucket, container or storage account, or a missing trusted site for a custom endpoint. Neither affects the server-side connection test, which is why it stays green.
- “We couldn’t access the credential(s)” is almost always the missing permission-set grant for the storage principal.
- Anything mentioning a challenge or verifying the org is the Integration User. See Set up the Integration User.
The Diagnostics tab in the Sliick Admin app shows the current configuration, processing status, stuck files and recent errors in one place. Start there.
Any external provider
Section titled “Any external provider”| Symptom, and where it appears | Likely cause |
|---|---|
In Sliick Files: Set the Integration User before creating credentials | The Integration User field on the Storage Settings form is blank. It is a prerequisite for every external provider. See Set up the Integration User. |
In Sliick Files: Could not verify the provision challenge against the org. | The Integration User is missing the Sliick Pipeline Integration permission set (Sliick Files Setup does not cover it), or a Sliick Files licence seat, or both. Assign them and retry: registration is idempotent. |
In Sliick Files: Could not verify this org | Sliick signed in to your org but could not confirm the registration. The Integration User is inactive, or is not pre-authorised on the Sliick integration app. |
| Selecting a file does nothing at all: no toast, no console error, no network request | Not a storage problem. The file list has no record to attach files to, because it is on a Home page, an App page, or an Experience Cloud page with no record bound. Place it on a record page. |
| Images stay in Processing for more than a minute | Open the Diagnostics tab and work down it. See The Diagnostics tab. |
Sliick Cloud Storage
Section titled “Sliick Cloud Storage”| Symptom, and where it appears | Likely cause |
|---|---|
In Sliick Files: We couldn't access the credential(s) | The running user has no Sliick Files User permission set. Assign it. |
Provisioning failed | Sliick could not set your org up. Usually the Integration User is missing, inactive, or not pre-authorised, or a transient network error. Click Connect to retry: retrying is idempotent. If it persists, contact Sliick with the error shown. |
HTTP 403 while connecting | Either the sign-in resolved a different org than the one claimed, or the Integration User is inactive or not pre-authorised, or your org’s Sliick Cloud entitlement is still off. Contact Sliick. |
HTTP 401 on a file operation | A signature mismatch. Disconnect and connect again to set your org up afresh. |
Endpoint is not allowed | The packaged Sliick Files credential is missing or the running user does not hold it. Confirm Setup → Named Credentials lists Sliick Files as enabled, and that the user has Sliick Files User. If the entry is missing entirely, contact Sliick: it ships with the package. |
Amazon S3
Section titled “Amazon S3”| Symptom, and where it appears | Likely cause |
|---|---|
In Sliick Files: Unauthorized endpoint | The connection did not finish setting up, or the endpoint is wrong. Reconnect in Sliick Settings. |
In Sliick Files: We couldn't access the credential(s) | The running user lacks External Credential Principal access for S3 Storage. Grant the principal on a permission set you control and assign it. See Salesforce setup. |
From AWS: 403 SignatureDoesNotMatch | The Region saved in Sliick Settings does not match the bucket’s region, or the secret is wrong. Re-enter Region and Secret in Sliick Settings and reconnect. |
From AWS: 403 InvalidAccessKeyId | The Access Key ID saved in Sliick Settings is wrong or deactivated. Rotate it in Sliick Settings. |
From AWS: 403 AccessDenied on PUT, GET or DELETE | The IAM policy on the access key does not allow that action on this bucket or key. Confirm s3:GetObject, s3:PutObject and s3:DeleteObject are granted on the bucket. |
Browser console: CORS policy: No 'Access-Control-Allow-Origin' header | Bucket CORS is missing or does not list your Salesforce domain. Re-do Configure CORS on the bucket and confirm every Salesforce origin is in AllowedOrigins: Lightning, My Domain, sandbox, scratch org if developing, and Experience site. Scratch-org domains look like https://<name>-dev-ed.scratch.lightning.force.com and must be added explicitly, because S3 CORS does not support wildcards for subdomains. |
In Sliick Files, as a toast or an upload-queue row: Could not reach storage from origin "..." | The same CORS rejection as above, shown inline instead of only as “Failed to fetch” in the browser console. Copy the origin from the message and add it to the bucket’s AllowedOrigins. |
| Upload succeeds, but the photo editor or a download fails | Uploads go browser-direct and need only the keys in Sliick Settings. Server-side reads also need the S3 Storage principal grant. See Salesforce setup. |
Browser console: Refused to connect ... violates ... connect-src | No trusted site covers your endpoint host. AWS, Wasabi, Backblaze B2, Cloudflare R2, Google Cloud Storage, Azure and SharePoint ship with one. A self-hosted or custom endpoint needs one adding. See S3-compatible providers. |
| Restore reports a deleted file as gone | Bucket versioning was off when the delete happened, so no delete marker exists, and enabling versioning afterwards does not create one retroactively. Or the access key lacks ListBucketVersions and DeleteObjectVersion. See Create the access key. |
| Changes made in an S3-compatible provider’s console never appear in Salesforce | Expected. Two-way sync is Amazon S3 only. See Two-way sync. |
Azure Blob Storage
Section titled “Azure Blob Storage”| Symptom, and where it appears | Likely cause |
|---|---|
In Sliick Files: We couldn't access the credential(s) | The running user lacks External Credential Principal access for Azure Blob Storage. Grant the principal on a permission set you control and assign it. See Salesforce setup. |
From Azure: 403 AuthenticationFailed | The account key in Sliick Settings is wrong or was rotated. Re-enter it in Sliick Settings and reconnect. |
From Azure: 404 ContainerNotFound | The container name you entered does not exist on the account. Create it in Azure or pick an existing one. |
Browser console: CORS policy: No 'Access-Control-Allow-Origin' header | Storage account CORS is missing or does not list your Salesforce domain. Re-do Configure CORS on the storage account. CORS is set at the storage-account level under Resource sharing (CORS), not on the container. |
| A blob deleted directly in the container is still on the record | Expected while blob soft delete is on, which is the recommended setting. External deletes do not sync on Azure. Remove the file in Salesforce too. See Two-way sync on Azure. |
| An Event Grid subscription reports Succeeded but never delivers | The system topic was created implicitly and silently failed. Create it explicitly first. See Two-way sync on Azure. |
Microsoft.EventGrid is not registered in Azure Subscription ... | Register the Event Grid resource provider on the subscription, once. |
Google Cloud Storage
Section titled “Google Cloud Storage”| Symptom, and where it appears | Likely cause |
|---|---|
In Sliick Files: We couldn't access the credential(s) | The running user lacks External Credential Principal access for GCP Storage. Grant the principal on a permission set you control and assign it. See Salesforce setup. |
From Google Cloud: 403 SignatureDoesNotMatch | The HMAC secret you entered differs from what Google Cloud expects, or the region you entered does not match the bucket’s region. |
From Google Cloud: 403 InvalidAccessKeyId | The HMAC access key was deactivated or rotated on the Google Cloud side. Regenerate and re-enter it. |
From Google Cloud: 403 AccessDenied | The service account behind the HMAC key lacks the right role on the bucket. Add Storage Object User. |
Browser console: CORS policy: No 'Access-Control-Allow-Origin' header | Bucket CORS is missing or does not list your Salesforce domain. Re-do Configure CORS on the bucket. The JSON has to be applied with gcloud; the console cannot set it. |
Uploads fail with Failed to fetch even though the origin is allowed | The CORS rule is missing the "*" entry in responseHeader, which file metadata sync needs. Re-apply the rule from Configure CORS on the bucket. |
403 SignatureDoesNotMatch on a multi-region or dual-region bucket | The Region in Sliick Settings must be the lowercase location name (us, eu, asia, nam4, eur4), not a specific region code. |
| An object deleted directly in the bucket is still on the record | Expected while Object Versioning is on, which is the recommended setting. External deletes do not sync on Google Cloud Storage. Remove the file in Salesforce too. See Two-way sync on Google Cloud Storage. |
SharePoint
Section titled “SharePoint”| Symptom, and where it appears | What it means |
|---|---|
In Sliick Files: Site URL is required | You clicked Discover without a Site URL. |
| Setup → Named Credentials has no SharePoint Graph entry | Expected on a fresh org, because the credential is not shipped in the package. Run Create SharePoint Credentials in Sliick Settings first. See Create the Salesforce credentials. |
In Sliick Files: Could not verify the provision challenge against the org. | The Integration User does not have what setup requires: the Sliick Pipeline Integration permission set (Sliick Files Setup does not cover it), and a Sliick Files licence seat. Assign them, then click Create SharePoint Credentials again. |
In Sliick Files: Set the Integration User before creating credentials | The Integration User field on the Storage Settings form is blank. It is a prerequisite for every external storage provider, not just Sliick Cloud. |
In Sliick Files: The external credential isn't fully configured | The AuthProviderUrl was not updated to the tenant-scoped token endpoint, or the App_Only principal has no Username and Password. Re-walk Set up Service Principal mode. |
From Microsoft: AADSTS90002: Tenant '<guid>' not found | The tenant ID in the AuthProviderUrl (Service Principal) or the Authorize and Token URLs (Delegated) is wrong. Double-check Azure Portal → Microsoft Entra ID → Overview. |
From Microsoft: AADSTS7000215: Invalid client secret provided | Wrong client secret on the App_Only principal (Service Principal) or the Auth Provider (Delegated). Copy a fresh secret from Microsoft and re-enter it. |
From Microsoft: AADSTS700016: Application ... was not found in the directory | The token endpoint’s tenant does not match where the app is registered. Point the AuthProviderUrl (Service Principal), or the Authorize and Token URLs (Delegated), at the Directory (tenant) ID on the app registration’s Overview page, and confirm the Client ID is right. |
From Microsoft: AADSTS50011: The redirect URI ... does not match | The Callback URL registered in Microsoft differs from the one Salesforce shows. Paste it, do not retype it: same scheme, host, casing, and no trailing slash. |
In Salesforce, on Delegated sign-in: Id_Token_Error: Missing id_token | The per-user credential’s scope is missing openid. New connects get openid profile automatically; on an older one, add it to the SharePoint_Graph_User External Credential’s Scope parameter. |
From Microsoft Graph: 400 BadRequest: Resource not found for the segment 'v1.0' on Discover | The per-user Named Credential’s URL includes /v1.0, which the client also appends. Set the SharePoint_Graph_User URL to https://graph.microsoft.com, the host only. New connects get this automatically. |
From Microsoft Graph: 403 accessDenied on /sites/root | Expected when using Sites.Selected. Root is not granted. Use a Site URL you have explicitly granted instead. See Grant access to the SharePoint site. |
From Microsoft Graph: 403 accessDenied on a granted site | The site grant did not land for this app. Re-confirm grantedToIdentities[].application.id matches your Client ID exactly. |
In Sliick Files: We couldn't access the credential(s) | The running user lacks the External Credential Principal access. Grant the SharePoint Graph principal on a permission set you control and assign it. |
| Sync: the toggle is greyed out, with a notice about contacting Sliick | Two-way sync is not enabled for your org yet. Contact Sliick. See Two-way sync. |
| Sync: the toggle is disabled and the org is connected per user | Two-way sync is not available in Delegated mode. See Set up Delegated mode. |
| Sync: a file added in SharePoint never appears on the record | Almost always the file is not in a {Record Name} - {recordId} folder, so there is no record to match it to. Check Storage Logs for a Skipped line, then move the file into the record’s folder. |
| Sync: a change takes minutes to show up | Expected. Graph batches its notifications. Press Refresh on the file list for an immediate pull. |
| Sync: Storage Diagnostics warns the webhook has expired | The subscription lapsed because nobody opened a file list for a while. Nothing is lost: opening a list or pressing Refresh renews it and pulls everything from the gap. |
Still stuck
Section titled “Still stuck”If none of these match, see Sliick Files support, or check the release notes in case the behaviour changed in a version you have not read about yet.