Troubleshooting | NVIDIA NeMo Helix

Use this page to find the right auth troubleshooting guide. The linked pages own the detailed steps so this page can stay short.

First Checks

curl -s "${NHX_BASE_URL:-http://localhost:8080}/apis/auth/discovery"
nemo auth status
nemo auth token --decode

Use these to confirm whether auth is enabled, which context and credentials the CLI is using, and whether token claims such as iss, aud, email, scope, or scp match the deployment configuration.

Symptom Map

Symptom	Start Here
`nemo auth login` fails, device flow is unavailable, scopes are rejected, or token claims do not match	OIDC Setup, then your provider page under Authentication
Client Secret Basic returns `invalid_client`, redirect mismatch, or the CLI unexpectedly starts device flow	Confidential OIDC Client
`401 Unauthorized` on API calls	Using Authentication for login, token inspection, SDK, and curl usage
`403 Forbidden` after login	Managing Access for workspace roles, and API Scopes for token scope restrictions
Workspace deletion fails with a conflict	Managing Access - Deleting Workspaces
Role changes do not take effect immediately	Authorization Concepts - Role Propagation Delay and Policy Engine - Bundle Caching
Gateway bearer-auth callout, trusted headers, or header stripping is not working	Gateway Integration
HelixAdmin does not have expected access	Auth Configuration - Bootstrap Admin and Security Model
Production hardening or secret handling questions	Production Hardening

If You Are Still Stuck

Check auth service, gateway, and PDP logs for the exact failed decision.
Confirm the request is reaching the expected gateway or service URL.
Compare token issuer, audience, email, groups, and scopes with the platform auth configuration.