> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshooting: ACCOUNT_LOCKED at dashboard sign-in > Resolve ACCOUNT_LOCKED (403) at the dashboard sign-in boundary — brute-force lockout windows, an owner/admin freeze, or a suspicious-login hold — and get back in without retry-looping. # Troubleshooting: ACCOUNT\_LOCKED at dashboard sign-in The dashboard sign-in boundary rejects attempts on a locked account with HTTP 403 and `code: ACCOUNT_LOCKED`. The rejection is deterministic: every attempt against the lock returns the same refusal until the lock clears, so the fix is to identify which lock you are under and clear it — not to keep submitting the form. This page covers the login lock on **dashboard users** (email + password). It is unrelated to API keys, which reject with their own codes, and to the WhatsApp Business Account lock Meta applies to your WABA — see the [coverage map](#coverage-map) at the end for those siblings. ## Symptom At sign-in, the request returns: ```json theme={null} { "status": "error", "code": "ACCOUNT_LOCKED", "message": "Too many failed login attempts. Please try again in 15 minutes." } ``` Until the lock clears, every attempt returns the same refusal before the credential check runs — including attempts with the correct password. The lock is on the account, not on a specific credential guess. ## Cause matrix Three independent sources apply a login lock. The recovery path differs, so identify yours first: | Cause | How the lock got there | Recovery path | | --------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Brute-force lockout | Repeated failed sign-in attempts on this email triggered the built-in failed-attempt lockout | Wait out the lock window, or have an owner/admin unlock you | | Owner/admin action | An owner or administrator of your organization froze your access (offboarding, a security hold, a disputed seat) | Only an owner/admin unlock restores access — the window never expires on its own | | Suspicious-login hold | Orbit's fraud screening flagged the login pattern (e.g. impossible travel, credential-stuffing bursts) and held the account | Have an owner/admin confirm you and unlock; use the [password reset](#password-reset-path) to rotate the credential if you suspect compromise | Only organization owners and administrators can clear a lock on another member. The unlock path is a tenant-owned control — Orbit support cannot unlock accounts on your behalf except through the break-glass route below. ## Fix steps Work these in order. Stop at the first one that restores access. 1. **Wait out the lock window (brute-force lockouts).** If the lock came from failed attempts, it expires on its own. Make yourself a coffee and sign in once — a single successful sign-in also resets the failed-attempt counter. 2. **Owner/admin unlock.** Ask any owner or administrator of your organization to open the members list, find your user, and unlock/unfreeze the account. This clears every lock class, including holds that never expire on their own. 3. **Break-glass via a second owner.** If the locked member is your organization's only owner, a second owner must unlock them. If nobody else holds owner/admin rights — a single-owner org where the owner is locked — open a support ticket with the details listed [below](#what-to-send-support); support treats that as a break-glass escalation rather than a routine unlock. ## Do not retry-loop — the reject is deterministic Repeatedly submitting the sign-in form does not shorten a brute-force window and does not bypass an admin or suspicious-login hold. Each attempt is refused with the same 403 before any credential check runs, so a retry loop only produces noise in your own audit view. Read the lock, clear it, then sign in once. ## Password reset path A password reset does **not** clear a lock — the reset flow validates your email ownership, but the lock check runs before the credential check, so resetting mid-lock still returns `ACCOUNT_LOCKED` at the next sign-in. Use reset in exactly one scenario: after the lock is cleared, when you suspect the failures were not yours (a suspicious-login hold, or failed attempts you do not recognize). Then rotate the password before signing back in. ## What to send support If you genuinely cannot reach an owner/admin (the break-glass case), open a ticket with: * The **email address** of the locked account. * Your **tenant ID** (Settings → Organization; a teammate's `organizationId` from `GET /api/v1/me` works too). * The **error code and message** exactly as returned, and the **`request_id`** from the response's `meta` block. * For a suspected compromise: the sign-in timestamps you do not recognize, so support can distinguish a hold from an admin freeze. Never include a password or a session token in the ticket. ## Coverage map The `ACCOUNT_LOCKED` family is deliberately small; do not confuse the login lock with these lookalikes: * [WhatsApp connection troubleshooting](/troubleshooting/whatsapp-connection) — `WHATSAPP_ACCOUNT_LOCKED` is **Meta's** lock on your WhatsApp Business Account after a sustained policy issue (Meta error 131031). It blocks WhatsApp sends, not dashboard sign-in, and recovery runs through Meta Business Support, not your organization owners. * [Authentication, key mode, and IP allowlist](/troubleshooting/auth-and-api-keys) — covers **API-key** rejections (`INVALID_API_KEY`, `EXPIRED_TOKEN`, `WRONG_KEY_MODE`, `IP_NOT_ALLOWED`) plus the SAML/SCIM gates on the login path. A revoked or expired key never reports `ACCOUNT_LOCKED`. * [Hot-desking sign-in rejects](/troubleshooting/hot-desking-sign-in-rejects) — the **voice-side** sign-in: binding an agent to a shared desk phone. Its guards (`HOT_DESK_RACE` 409, terminal-state 410/404) are session-ledger races, unrelated to the login account lock. ## See also * [Error codes reference](/reference/error-codes) — `ACCOUNT_LOCKED` and the full authentication group. * [Authentication](/authentication) — dashboard sessions, API key formats, and rotation. * [Troubleshooting hub](/reference/troubleshooting-hub) — every runbook by failure class.