A Cloud Key Was Rejected
A record on your workspace's own cloud, such as a data store or a database, says it could not be read, or the Cloud Connections menu item has a badge. The cloud key is the likely cause.
What happened
Your workspace reaches Azure with a key. Azure has stopped accepting it: the key was rejected or it expired, or the directory has not approved the app the key belongs to. The workspace checks each connected cloud's key on its own and keeps the answer for a few minutes, so you see this without opening Cloud Connections. Nothing in your cloud was changed.
What you see
| Where | What it says |
|---|---|
| The Inspector, on a record | The health line, ending in when the check ran ("Checked 3 minutes ago"; hover for the exact UTC time), then an attention notice: why the record could not be read, what to do, and a Renew Connection button. If the cloud is not connected, the button reads Open Cloud Connections |
| Environment -> Cloud Connections | A badge on the menu item with the number of clouds that need you; hover it for "1 cloud needs attention" or "2 clouds need attention". The cloud's card in the window shows Connection failed |
get_workspace | A CloudStatus entry for the cloud: a Label, a Remedy, a Code and CheckedAt |
The Label and Remedy in get_workspace read:
| State | Label | Remedy |
|---|---|---|
| Key rejected | Key rejected | Azure rejected this cloud's key. Open Cloud Connections and choose Renew Connection. |
| Key expired | Key expired | This cloud's key has expired. Open Cloud Connections and choose Renew Connection. |
| Approval needed | Approval needed | This cloud's directory has not approved the app it uses. Open Cloud Connections, choose Renew Connection and approve access when asked. |
| Not connected | Not connected | This cloud is not connected yet. Open Cloud Connections and connect it. |
While the key is in one of these states, the workspace does not try to read the record at all: the record says it could not be read, never that it is down or gone.
Get it back
- Press Renew Connection in the notice. It opens Cloud Connections, which checks the connection and goes to its renew step. Or open Environment -> Cloud Connections yourself.
- Press Renew Connection in the window. On a managed cloud that is the whole step: there is no Azure sign-in. On a cloud you connected yourself, sign in to Azure when asked.
- Wait for the renew to finish. The window says "Renewed. Everything built on this cloud uses the new key on its next call; there is nothing to deploy."
If the approval was the problem, approve access when Azure asks. If the window offers Reconnect Cloud rather than Renew Connection, the app registration is not OpenX's own, so you reconnect through Microsoft.
If Renew says the new key was not accepted
Renew tries the new key before it turns the old one off. If the new key is not accepted in time, the old key stays in place and the renew says:
The new key was not accepted in time, so the connection keeps its current key. Try Renew again later.
Nothing was turned off and nothing was lost. Press Renew Connection again after a little while.
If it says Couldn't check
Couldn't check means the check did not reach an answer, for example because of a network error or a timeout. Nothing is known about the key, so this is not a failure: there is no badge and no notice, and the records are read as usual. The check runs again by itself; or press Recheck this connection now in the window.
If the checks keep failing to answer for an hour, get_workspace says when they started:
Couldn't check since 2026-10-27 12:00 UTC.
Related
- Cloud Connections: connect, check and renew a cloud.
- get_workspace: the
CloudStatusfields. - By Symptom: other things you might be seeing.