> ## Documentation Index > Fetch the complete documentation index at: https://docs.envzero.com/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshoot the env zero CLI > Fix common env zero CLI errors and surprising results: auth and permission exits, repository access, truncated lists, approvals, waits, TTLs, and tags. Each section starts from what you see. For the meaning of each exit code, see [Exit codes](/guides/community-and-resources/support-and-help/env-zero-cli/command-reference#exit-codes). ## Sign-in and permissions ### A write command exits 3 with valid credentials The key or user is missing the permission for that operation. A `403` maps to exit `3` (`auth`), and `error.message` names the missing permission. Deploying needs deploy permission on the project. Creating projects and managing templates need organization-level permissions. All `api-key` commands, including `list`, need the **Edit Organization Settings** permission. Check the [role](/guides/admin-guide/user-role-and-team-management/rbac) behind the credential. ### A get command exits 3 instead of 4 For ids outside your access, the API answers `403` rather than `404`. Treat exit `3` on a `get` as "missing or not permitted". ### login exits 3 in CI Browser sign-in needs a terminal. Set `ENV0_API_KEY_ID` and `ENV0_API_KEY_SECRET` instead. Other commands read them directly, so CI does not need `login`. ### Commands exit 3 after changing --api-url Credentials are stored per host. Run `env0 login` against the new host, or pass an API key for it. ### login exits 64 against a custom host Browser sign-in cannot tell which env zero tenant serves the host. Pass `--tenant prod`, or sign in with an API key. ### stderr shows "could not save credentials to the OS keychain" The CLI stored your credentials in a plain-text file instead, readable only by your user. The warning names the file, and `env0 status` shows it as `credentialFile`. `env0 logout` removes it. ### A revoked key still works A revoked key can keep authenticating for a short time. Treat a revoke as the first step in containing a leaked key, not an immediate cut-off. ## Create and deploy ### environment create exits 2 with correct arguments Organization plan and quota limits, such as a cap on environments, are reported as `user_input` (exit `2`). Read `error.message` instead of re-checking the flags. ### "You have no access to that repository" The VCS connection does not cover the repository: * The connection's `accessScope` in `env0 vcs list`, for example `Organization:acme`, must match the repository's owner. * For a GitHub App connection, the repository must be in the App's selected repositories. Check this in GitHub. ### The deployment came back QUEUED Another deployment is running on the environment. Yours runs after it. Drop it with `env0 deployment cancel `. ### The plan succeeds and the apply fails with a cloud 403 The cloud identity behind the deployment lacks an IAM permission, for example `storage.buckets.create`. A plan on a new environment often succeeds without cloud access because there is no state to read. Grant the role in your cloud provider, then run `env0 environment deploy ` again. ### The next command does not use the project you created `project create` does not change your stored project. Pass `--project `, or run `env0 project use `. ## Waiting and approvals ### --wait exits 0 but nothing was applied The deployment is at `WAITING_FOR_USER`, which counts as success for `--wait`. Approve it with `env0 deployment approve `, or cancel it with `env0 deployment cancel `. Passing `--yes` to `destroy` does not skip approval. ### deployment approve exits 2 with "environment is not WAITING\_FOR\_USER" The deployment already moved on. The error is harmless; do not retry. ### --wait exits 75 The wait hit `--timeout`, default `1h`. The deployment may still be running. Run `env0 deployment logs --follow` to keep watching, or raise `--timeout`. ### Logs do not appear on stdout With `--wait`, logs stream to stderr so stdout holds only the final deployment. Redirect with `2>&1`, or stream on stdout with `env0 deployment logs --follow`. ## Lists and output ### A list has exactly 100 rows `environment list`, `deployment list`, and `plan list` stop at 100 rows by default. If `.page.truncated` is `true`, pass `--all`. ### environment list --name returns nothing `--name` matches the exact name, not a substring. Add `--project` so a same-named environment in another project is not picked. ### Workflow sub-environments are missing from environment list `environment list` does not include them. Run `env0 context ` and read `.data.subEnvironments`. ### plan get returns no resource changes Check `.data.planAvailable`. When it is `false`, no plan was stored for that deployment, and the arrays are empty for that reason. Most deployments, including those waiting for approval, do not store a plan. ### planSummary counts more resources than resourceChanges `planSummary` counts expanded and internal items that `resourceChanges` does not list. Use `resourceChanges` or the deployment's `resourceCount`. ### costEstimation is null [Cost estimation](/guides/policies-governance/cost-estimation) is off for the organization, or the deployment produced no estimate. It is not an error. ## TTL and tags ### --ttl or ttl set exits 2 with "Min lifespan is 1h" The shortest lifespan env zero accepts is one hour, and a timestamp must be in the future. ### ttl set shortened the lifespan `ttl set` counts a duration from now, not from the current end. To add time, run `env0 environment ttl extend `. ### ttl extend exits 2 The environment has no TTL. Give it one with `env0 environment ttl set `. ### tag set removed a value `tag set` replaces each named key's whole value list. Pass every value you want to keep, for example `team=eng team=payments`. Run `env0 environment tag list ` first to see the current values. ## Workflows Manifest and `--node` errors are covered in [Deploy workflows with the CLI](/guides/community-and-resources/support-and-help/env-zero-cli/workflows#alias-checks). ## Next steps * [Command reference](/guides/community-and-resources/support-and-help/env-zero-cli/command-reference) - Every CLI command and flag. * [Contact support](/guides/community-and-resources/support-and-help/support) - Get help from the env zero team. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.