Troubleshoot common sign-in issues.


:::info
If you have problems signing in, refer to the instructions on this page. To get more help, reach out to your Customer Success Manager (CSM) or [support@cobalt.io](mailto:support@cobalt.io).

:::


:::tip
## Tip

Before proceeding, ask your Organization Owner if SAML-based single sign-on (SSO) is enforced for your organization. If yes, sign in from the identity provider (IdP) system, not the Cobalt Sign In page. For more troubleshooting tips, see Can’t Sign In Using SAML SSO, below.

:::

Follow these instructions if you can’t sign in to Cobalt because:

* You have problems with two-factor authentication (2FA):
  * You lost access to your authenticator
  * One-time codes don’t work
  * “Remember this device” option doesn’t work
* You forgot your password
* Your account isn’t fully set up
* Your email or password is invalid
* You have problems with SAML SSO
* You’re locked out of your account
* The sign-in page doesn’t load
* You believe your account was compromised

## Here are some general tips that may help.

* Sign in from another browser.
* Turn on incognito mode in your browser.
* Clear your browsing data.

## Problems with Two-Factor Authentication

### Lost Access to Your Authenticator

If you lost access to your authenticator, ask your [Organization Owner](https://docs.cobalt.io/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-owner) to [turn off two-factor authentication (2FA)](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-turn-off-2fa-for-a-user) on your account. If you’re the only Organization Owner, contact your Customer Success Manager (CSM) or [support@cobalt.io](mailto:support@cobalt.io) for help.

Once your Organization Owner has turned off 2FA, you get an email notification. You can now sign in without a second authentication factor.

If you have a [recovery code](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-recovery-code) enabled:

[https://www.loom.com/embed/eebe34fc674a4fe5917ac6b94a445997?sid=7a3aab21-0c0f-44c6-b43c-95f01e5ef5bb?hide_owner=true&hide_share=true&hideEmbedTopBar=true](https://www.loom.com/embed/eebe34fc674a4fe5917ac6b94a445997?sid=7a3aab21-0c0f-44c6-b43c-95f01e5ef5bb?hide_owner=true&hide_share=true&hideEmbedTopBar=true)


1. Sign in as usual with your email and password.
2. Under **Verify Your Identity**, select **Try another method**, then **Recovery code**.
3. Enter your saved recovery code. You will be prompted to save a new recovery code for future use before access to your account.

To protect your account, [enable 2FA](https://docs.cobalt.io/en-us/articles/account-settings-8tW4UtYkk3#h-two-factor-authentication).

### Turn Off 2FA for a User

As an [Organization Owner](https://docs.cobalt.io/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-owner), you can turn off two-factor authentication for a user. A user who needs help with 2FA should contact their Organization Owner directly.

If you’re the only Organization Owner, contact your Customer Success Manager (CSM) or [support@cobalt.io](mailto:support@cobalt.io) for help.

To turn off 2FA for a user:


1. On the **People** page, locate the user who needs help with 2FA.
2. Select the three-dot icon on the right, and then select **Turn Off 2FA**.
   * We recommend that you verify the user’s identity before turning off 2FA. ![](https://brainfish-storage-prod.s3-accelerate.amazonaws.com/uploads/e1eb5d82-35e0-4c9f-bde1-0baec07941c1/ee0b9f44-c495-4b1c-8980-7af5fe43d5fa/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAUPPN5IL3V2Z2DCXR%2F20260425%2Fus-east-2%2Fs3%2Faws4_request&X-Amz-Date=20260425T135925Z&X-Amz-Expires=3000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEMn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMiJGMEQCIADmiPUevBe53B5eLvrD2F0oNxFkHGxtz%2Bm9ff%2BlIymAAiBWzUFp352UnaJmKwnoSgihvzcOBII0%2F96jGK3sacMfDCrmBQiS%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAIaDDMwODEyNTk3NTI4NyIM2Tiob7qtcGgdffkWKroFFaLQS%2BkJXFDXjnVPJdOiv6xsPDNRSLUOBDvwcpKw%2Fj3A%2FcT4p2tW%2B0%2FbcdWHoIYCPzAg9ITsDP0qvCN7WSgzIO57q8LqfjEJzL4DbJpeE%2FIekjB%2F6zmBm4enzs7M7L8Xigdjep%2B3hjJlAe%2BbbLAKA9oAdden6aTTrzuqbB1z%2F5i0%2FCdyvn8gk0%2FbiTt7tSZ14cd3VyzVSuMTP%2Fy0LQcnoC4vKTOoto%2BGqBnsIf%2Bu9Qd5FqDZnVzYS87KhA4A2tQO7YCV3Ji7DJhngV5jyW8LE95K8Yp5Yf1WH3qJNJ75v4Fqg6NwHoIFXDUNyf2JyS3szcKKYmjm2N%2F83fAQrCxq122MfrAQrIRC1la2LJpHqXnyl0cS7RAmFYnWprB7tFU0Ye2THYQ42yqfNtAqfbOQ7yEqpPv5isWrMoKoHZuvmmX2HifPV0Es0iY%2BEubBp2LOskUPYfj8BxGc%2FfKzka6OqknEX3NkAdnfZ5AkmlwvljeejWYSlr5FCFNIfkJB%2FOv6e2eiihxSrQ68cKFoWGBLN8TrC34wSCTn47UVfY8rRp5xL5kDCJpK6hCESEUKbE6l%2Ffg%2FxOx9b%2BUMHDNemO%2FjWpcdSB%2BkTbZWn7wkLtifD1lefx4e2y6Ip8KFns8XbJtdp7FLTkulFqw%2BCQDsIGclz6F61sWGWkmPk%2BSDVua5kWXDo6%2BNnOf5cCjLAh3ekPI6VkT3KMYi4Aa1pOCauugudSulbcT662UqmZFvXSe%2Fb5%2Beo1eFv1qkkpbl%2BlsqMV9D%2FmjpqCsGjRbEKHvoB%2FelkZRkxEmQbXMJCSBCBdFolL7u696%2B7bnLA3pXi4S7zavXkMs84S3agGJEtvsBaNk8PE5Fqg3xs7UfbgaBVpeEqinnd6%2FyG8%2Fr3VCgrJQT7%2Fxx%2BXV7GV3gq2WAPa1Rq%2F9IjrE8LMouZRTBETUw4oCyzwY6kQFID4U5KNi%2FXlwVGWEVS6VFdNJF%2BwyLZytHUzHOjW3zv8Hr4xiInnCJGZ5z%2FaXgVxuOzFxAKLHznJKzDMcHxVHdI3b53C%2FC%2BJabD%2BS3SeL8n058t3SOcvvawEzEA9zOxZZ3kPElAgr3gnhZqS%2BItq0dl5ldS8EWWfjg5Xm%2BM0cH3RvJHiamitWkq1tQL%2FBfXEa1&X-Amz-Signature=183e5e2a5252f7fd62eda29fbcb04482c82743a0e31cfe149347a2ef72f419dc&X-Amz-SignedHeaders=host&response-content-disposition=attachment)
3. Select **Confirm** in the overlay that appears.

### One-Time Codes Don’t Work

One-time codes that your authenticator app generates are time-based. If the codes that you enter when signing in are invalid, do the following:

* Enter the code promptly, within 30 seconds as it appears in the authenticator app.
* Make sure the time is synchronized between the devices. If you manually changed the time zone on your mobile device earlier, select the system time zone.

### “Remember This Device” Doesn’t Work

When you sign in to Cobalt using 2FA, you can select **Remember this device for 30 days**. This option works for a specific device and browser.

You need to enter a one-time code from your authenticator if:

* You’re using a different device or browser.
* You cleared cookies from your browser, or you haven’t enabled them.
* You’re browsing in incognito mode.
* You’re using a different internet connection.
* Another user signed in on the same device using the same browser.

## Forgot Your Password

To reset your password:


1. On the [Sign In](https://app.us.cobalt.io/) page, select **Forgot password?**.
2. Enter your email address that you used to [sign in to Cobalt](https://docs.cobalt.io/en-us/articles/sign-in-to-cobalt-EGTXEey2h8), and select **Reset Password**.
3. Follow the instructions in the email you receive. Learn [how to create a strong password](https://docs.cobalt.io/en-us/articles/password-best-practices-5wuZLWBn0e).

## Email or Password is Invalid

When you sign in, you may see an error stating that your email or password is invalid.

Ensure that:

* Your Organization Owner has [invited](https://docs.cobalt.io/en-us/articles/manage-users-e390HqcTEl#h-invite-users) you to the Cobalt platform. You have fully set up your account in Cobalt and are signing in with the registered email address. Learn more about [setting up your account](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-account-isnt-fully-set-up).
* The password you’re entering is correct. If you forgot your password, [reset](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-forgot-your-password) it.

If you’re locked out of your account, see our [troubleshooting tips](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-locked-out-of-your-account).

## Account Isn’t Fully Set Up

To use the Cobalt platform, you need to fully set up your account.


1. Ask your [Organization Owner](https://docs.cobalt.io/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-owner) to [invite you to your organization](https://docs.cobalt.io/en-us/articles/manage-users-e390HqcTEl#h-invite-users) in Cobalt, if they haven’t already done so.
2. Confirm your email address by clicking the link in the email invitation.
3. Create a password.

Possible problems:

* If you’re not receiving emails from Cobalt, see our [troubleshooting tips](https://docs.cobalt.io/en-us/articles/manage-notifications-51o6Nw66ug#h-troubleshoot-email-notifications).
* If the invitation link in the email has expired, ask your Organization Owner to invite you once again.
  * If you’re an Organization Owner: To resend an invitation to a user, [remove them from your organization](https://docs.cobalt.io/en-us/articles/manage-users-e390HqcTEl#h-remove-users), and then [invite](https://docs.cobalt.io/en-us/articles/manage-users-e390HqcTEl#h-invite-users) them again.
  * If you’re the only Organization Owner in your organization: To get help, contact your Customer Success Manager (CSM) or [support@cobalt.io](mailto:support@cobalt.io).

## Can’t Sign In Using SAML SSO

If your organization has enforced [SAML SSO](https://docs.cobalt.io/en-us/articles/sign-in-to-cobalt-EGTXEey2h8#h-saml-sso), sign in from the identity provider system, such as Okta or OneLogin. Authentication from the Cobalt [Sign In](https://app.us.cobalt.io/) page is not possible.

* If you don’t know what identity provider your organization uses, contact your Organization Owner.
* If you don’t see the Cobalt app within your identity provider, contact your IdP admin. They’ll add Cobalt to your IdP account.
* Ensure that you’re a provisioned user both in the IdP system and Cobalt. Complete the account setup process for Cobalt, which includes confirming your email address and creating a password. The email address for your IdP and Cobalt must match.

For [Organization Owners](https://docs.cobalt.io/en-us/articles/user-roles-and-permissions-oCij6uRrUR#h-organization-owner):

* Ensure that your [SAML SSO configuration](https://docs.cobalt.io/en-us/articles/configure-saml-sso-oT8Q3qO09D#h-troubleshoot-your-saml-sso-configuration) is correct.
* If you’re using a legacy SAML configuration, [update it to the new setup](https://docs.cobalt.io/en-us/articles/saml-migration-update-your-configuration-LqzlyEpUSj).

## Locked Out of Your Account

If you make several unsuccessful attempts to sign in, we’ll temporarily lock your account.

To unlock your account, follow the instructions in the email that you receive. If you still can’t sign in, contact us at [support@cobalt.io](mailto:support@cobalt.io).

## The Sign-in Page Doesn’t Load

If the Cobalt [Sign In](https://app.us.cobalt.io/) page doesn’t load, try to clear your browser’s cache through a hard refresh. The most recent version of the sign-in page should load.

Instructions vary depending on the browser and operating system you’re using. There may be several ways to complete this action.

## See instructions.

* **Chrome**:
  * **Windows**: Press Ctrl + F5.
  * **Mac**: Press ⌘ Cmd + Shift + R.
* **Firefox**:
  * **Windows**: Press Ctrl + F5.
  * **Mac**: Press ⌘ Cmd + Shift + R.
* **Safari**: Press Option + ⌘ Cmd + E.
* **Microsoft Edge**: Press Ctrl + F5.

## Account Was Compromised

If you believe your account was compromised, reach out to your Customer Success Manager (CSM) or [support@cobalt.io](mailto:support@cobalt.io). We’ll temporarily lock your account and open an investigation.

If you have access to your Cobalt account, do the following:


1. [Change your password](https://docs.cobalt.io/en-us/articles/account-settings-8tW4UtYkk3#h-change-your-password).
2. [Reset two-factor authentication](https://docs.cobalt.io/en-us/articles/account-settings-8tW4UtYkk3#h-reset-two-factor-authentication).

## Error Messages upon Signing In

Here are the most common error messages you may see upon signing in to Cobalt.

| Error | Details | Troubleshooting Steps |
|:---|:---|:---|
| You have to confirm your email address before continuing | You haven’t fully set up your account on the Cobalt platform. | Confirm your email address by clicking the link in the email invitation, and then create a password. Learn more about [setting up your account](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-account-isnt-fully-set-up). |
| Invalid email or password | The email address or password that you’re using is incorrect. | See our [troubleshooting tips](https://docs.cobalt.io/en-us/articles/troubleshoot-sign-in-issues-XLCGFWuPqk#h-email-or-password-is-invalid). |




Troubleshoot Sign-in Issues

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

User Account

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Finding States

Severity Levels

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

User Roles and Permissions

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Track Your Credits

Cobalt Credits

Cobalt PtaaS Tiers

Credits

Cobalt Integrations Overview

Troubleshooting

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitLab tickets for Findings

Create GitHub tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

Create Azure DevOps Work Item for Findings

Send MS Teams notifications for Findings

How to Guides

Connect your applications

Integration Builder

Synchronize Cobalt Severity Levels with Jira

Push Cobalt Findings to Jira

Jira Cloud Integration

Jira Data Center Integration

Troubleshoot Your Jira Integration

Switching to a New Jira Instance

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation

Troubleshoot Sign-in Issues

Share

Share

Troubleshoot Sign-in Issues

Share

Share