Registration & Logging In Troubleshooting

Check the instructions for the error below. If that doesn’t help, collect the app sign-in logs and contact your organization or eXpress support.

App Asks You to Enter Letters or Listen to Audio Against Background Noise (Captcha)

To protect eXpress from SMS spam, a Captcha is used. On some devices that the system deems suspicious, you might be asked to pass a verification: enter letters by reading them from an image or listening to an audio clip.

The following can help reduce the likelihood of this verification appearing:

• Regularly update your browser and your device's operating system. Don't use outdated devices.
• Disable third-party extensions and ad blockers in your browser.
• Try to avoid connecting to public WiFi networks in public places (subway, cafes, airports).
• Make sure the system time on your device is synchronized — more details.

If you are unable to pass the Captcha verification, contact your organization’s support or eXpress support.

Error After Requesting an SMS Code | SMS Code Is Incorrect or Not Received

Possible errors:

• The SMS with the verification code does not arrive
• “The server is temporarily unavailable”
• “The server with the specified hostname could not be found”
• “Error sending SMS, try again later”

Having Trouble Connecting?

Disable VPN or proxy, try another network.

Did You Change Your SIM?

If you recently changed your SIM card or mobile carrier, wait 24 hours.

“Invalid Number or Country Code” | Entered Something Wrong?

• Check your phone number. Only mobile numbers are supported. Ensure the country is correct — some SMS providers do not send codes to certain countries.
  For Administrators: Why Phone Number Validation May Not Work on ETS

  ETS

  For this feature to work, the SMS provider must also return the appropriate errors. We've added support for SMSC, Twilio, and sms_country providers. If a different SMS provider is used on

  ETS

  , the feature will not work.
• Check the code input. Each code is valid until a new one is requested. SMS requests can be sent no more than once per minute.

Requested SMS Too Many Times?

Ensure you haven’t exceeded the SMS code limit. Contact your organization's support or eXpress support (only if you are using the eXpress app).

For Administrators: SMS Limit Exceeded

RTS

ETS

Check the block in the admin panel (“Security” > Unblock user).

To check SMS status, in the “SMS Statuses” section, enter the number (with country code, without “+”). The one_number_limit_exceeded error means the limit is exceeded. The user can try again after 00:00 or sign in via QR code.

For Administrators: Bad Request Error, Reason: Blocked

RTS

ETS

The error means the number is blocked due to frequent SMS requests or an administrator’s restriction.

For

ETS

: unblock the number in SMS > Security. For unlocking on

RTS

, contact eXpress support. Limits are configured in the same section.

If the number is listed in Filter by phone, remove it and restart the authentification service. The authentification logs for such a number will show Blocked by phone number XXXXXXXXXXX.

Is the SMS code not arriving for a foreign number?

SMS delivery to numbers of some foreign operators is suspended. This is a restriction on the side of the SMS provider, the operator, or the country, and cannot be bypassed through app settings.

If you are already signed in to eXpress on a computer, you can sign in on your phone without SMS — using a QR code. See “QR code”.

If you do not have an active session, contact eXpress support and provide your country and operator — we will check whether delivery is possible.

The SMS was sent but does not arrive?

On your mobile device, try the following:

• Free up phone storage from old messages.
• Restart the device.
• Check blocklists and spam filters in the Messages app.
• Remove third-party SMS apps.
• Try the SIM card in another known-working phone.
• Request the code again after some time.

If the recipient is available for SMS reception, the operator will deliver the message. If the steps do not help — the issue is likely on your mobile operator's side.

Mobile Provider/Carrier Blocking SMS?

There may be issues with the SMS provider or carrier. Ensure the carrier hasn’t blocked automated SMS or restricted SMS codes.

Why the Number Ends Up on the Carrier's Stop List

Carriers process personal SMS and SMS from services (verification codes, notifications) under different rules, so delivery may be blocked only for service messages. Typical reasons:

• Spam complaints. If complaints have been filed against the number, it may have been added to a blocklist automatically.
• Persistent delivery failures. After a series of unsuccessful attempts, the number is marked as invalid.
• Suspicious activity. Mass messaging and unusual traffic volumes trigger the platform's protective mechanisms.
• Manual block. The carrier may close delivery by decision of its security service.
• Services on the number. An enabled ban on service or advertising messages also cuts off verification codes.

Only the carrier itself can check and remove the restriction: contact its support and ask them to check whether receiving service SMS is blocked on your number.

For Administrators: SMS Provider or Carrier Issues

ETS

Check the sending history in the SMS Statuses section. If SMS isn’t delivered, check with the provider—the subscriber may have blocked automated messages.

Server Issues?

If the account is linked to a non-working corporate server, contact eXpress support.

Unhandled_service_error | “An Error Occurred” After Entering the SMS Code

The error may only appear in the logs.

Possible causes

• The corporate server is unavailable or data is incorrect.
• The server certificate is expired or issued incorrectly.
• Rarely—account deletion and re-registration are required (see below).

How to Resolve This?

Contact your organization’s support team or eXpress support.

For Administrators: Corporate Server Is Down

Lite

CTS

ETS

eCTS

If the server linked to the user is unavailable, check its status via eXpress support. You may need to delete the server on

RTS

.

For Administrators: Certificate Issues

CTS

ETS

eCTS

Errors in the browser console ((Fn +) F12 > Console tab): ERR_CERT_AUTHORITY_INVALID, or in the authentication logs: Trust anchor for certification path not found, javax.net.ssl.SSLHandshakeException: Handshake failed, indicate certificate issues. Check:

• Device certificates (instructions).
• Server certificate validity and correctness (documentation).

For Administrators: Different HUID on RTS

CTS

ETS

eCTS

eXpress support will check and fix the account.

For Administrators: Account Deletion and Re-Registration in ETS App Required

ETS

If other methods didn’t help:

• Log the user out.
• Install eXpress, sign in with the same phone number.
• Delete the account via eXpress: Settings > Profile > three dots > Delete Account.
• Register again in the
  ETS
  app.

“Login Without a Phone Number Is Not Allowed” Error

The error occurs when trying to sign in via email or server address.

How to Resolve This?

The administrator has disabled sign-in without a phone number. Use a phone number.

“Invalid Credentials” (Incorrect Login or Password for Corporate Account)

The authentication logs will show the invalidCredentials error.

How to Resolve This?

Check the corporate server sign-in details. The username, password, and server address can be confirmed with your organization’s support team.

For Administrators: User Is Missing on the Server

The error may occur if the user was not created manually or has not been synchronized from the corporate directory. Create the user manually, either configure synchronization, or run it manually, or wait for it to complete.

For Administrators: AD Requires Password Change on Next Login

If the User must change password at next logon flag is set in AD, clear it — the user can sign in with the new password.

For Administrators: “Channel Binding Token Requirements = Always/When supported” Policy Is Set in AD

If the Domain Controller: LDAP server channel binding token requirements AD policy is set to Always or When supported, follow these steps to enable user login in eXpress:

1. Update eXpress to the following versions or higher:
   • Server software: 3.60
   • Web/Desktop: 3.61
   • Android: 3.62
   • iOS: 3.63
2. In the administrator panel, in the Active Directory section, enable the Enable NTLM channel binding (CBT) checkbox.

If the server software and clients are below the specified versions, AD login will not work even with the correct username and password. If you cannot update the server software and clients quickly, set the Domain Controller: LDAP server channel binding token requirements policy to Never.

For Administrators: AD User Principal Name ≠ User Logon Name

If the fields differ in AD, the user must enter:

• Login — UPN,
• Password — domain password,
• Domain — leave empty.

For Administrators: User Login Has Exceeded the Maximum Length in AD

Check that the login has not exceeded the maximum length of 20 symbols in the Active Directory. If the login is longer, try entering the login and domain in the login@domain format in the login field and clear the Domain field.

For Administrators: Check the Logout Request

Check the reason in the admin panel — the automatic logout request might occur.

For Administrators: The AD Account Is Configured to Allow Sign-In Only From Specified Computers

ETS

If an AD account is configured to allow sign-in only from listed computers, during NTLM sign-in the desktop app might not have passed the computer name, and AD rejected the attempt.

Ask the ETS app vendor to release a new build with a parameter that will pass the computer name from the system.

Maximum Number of Authentication Attempts Exceeded

The Active Directory login attempt limit has been triggered. This block will be lifted automatically (default: after 10 minutes). If you’re signed in on another device, use the QR code. If the password is lost or you can’t sign in, contact your organization’s support team.

For administrators: In the “Audit” section, this appears as the max_failed_login_attempts_reached error.

“User Not Found”, “User Not Registered on the Server”, or “Email or Login Not Found” Errors

Possible causes

• Incorrect login, password, or email address entered;
• The corporate server account has not been created yet, or there is an issue with directory service synchronization.

How to Resolve This?

Check the entered data. Try entering the corporate email in lowercase. If the issue persists, contact your organization’s support team.

For Administrators: User Not Registered on the Target Corporate Server

1. Find the user in the
   CTS
   /
   eCTS
   admin panel under Users.
2. In the Audit section, ensure the user is not registered and the correct email is specified.
3. If the user is registered, provide the user’s phone number to eXpress support for verification.

For Administrators: User Account Blocked in AD

When an account is manually blocked in AD, the user is redirected to the server address entry screen. A logout request appears in the admin panel. Upon subsequent login attempts, the user receives the error Incorrect login or password or User not found.

Solution: Unblock the account in AD or perform manual synchronization to create a new user account (if applicable): Registration Settings > Sync.

For Administrators: User Enters Incorrect Authentication Data

Verify the login and email the user is using. You can request a screenshot of the error — it will show the server name. If the data is correct, ask the user to collect login logs and send them to eXpress Support.

For Administrators: AD User Not Displayed in the Admin Panel

1. Check if the user is in the AD synchronization group.
2. Wait for synchronization to complete or perform it manually: Registration Settings > Sync.
3. If the issue persists, collect logs from the ad_integration service and contact eXpress support.

For Administrators: AD User Missing Email in the Admin Panel

1. Check the number of user accounts. A name change may have created a new account. If there are two, log out the old account and sync with AD.
2. If unresolved, enable debug logging for the ad_integration service, collect container logs, and forward them to eXpress support.

“User Already Registered”, “This Login Already Used”, or “This User is Already In the System” Errors

Are You Using a Different Phone Number?

Maybe you are trying to log in with a number not used during registration. Enter the original number or link a new number (if allowed by your administrator).

For Administrators: User Uses a Different Phone Number

Verify the phone number. eXpress support can check the number’s association to

CTS

/

eCTS

. If unlinked, ask the user to enter the original number.

For Administrators: Cached Old Number in Use

The error occurs if the user forgot the number and is mid-authentication. Restart the process. If unresolved, check ad_integration service logs.

Is Your Account Connected to Another Server?

If you changed employers, contact the previous employer to log out the account. Corporate correspondence is company property; the former employer must log it out. The app may have had a different name, not eXpress.

For Administrators: Number Linked to Another Server

Check the number link via eXpress support (on

RTS

) or the admin panel (on

ETS

). If linked to another server, request user logout via eXpress support.

Did Your Login Details Change?

If login (e.g., due to a name change in Active Directory) or password changed, contact your organization’s support team to log out the old account and switch to the new one.

For Administrators: AD Login Changed

1. Log out the old account.
2. Sync with AD: Registration Settings > Sync.
3. Verify the user’s email in the admin panel.
4. Ask the user to log in with new credentials. ?? To retain correspondence, they must log in to the same server with the same phone number, then rejoin group chats and channels!

For Administrators: Error After AD Password Change

Click Clear cache in the user’s admin panel profile. To prevent future issues, uncheck User must change password at next logon in AD.

Trying to Use Phone Login When You Registered Without One?

You previously logged in without a phone number, then logged in to the same server with one. These are technically different accounts. To link the number to the “numberless” account:

1. Log in with the phone number (skip corporate data entry).
2. Delete this account.
3. Log in to the corporate account without a number and link the freed number (if allowed by your administrator).

For Administrators: Login Method Mismatch

Verify if a number was used during registration. Assist the user in deleting or changing the number in the profile if needed.

Did You Accidentally Use External Account Login?

Logging in via an external client account is not allowed. Contact your organization's support.

For Administrators: Login via External Client Account

Accounts in the “External client users” section are for conferencing terminals only. Change the external client account’s email to another one in the External clients users (since version 3.50) or in the “Users” section (prior version 3.50) so the user can log in to the correct regular account with their email.

Trying to Log In Without Phone When Not Allowed?

If the administrator disabled numberless login, contact your organization’s support team to temporarily allow numberless login so you can add a number.

Network Errors and Connection Issues

Possible error messages

• “Network error, check your connection to the server”;
• “The server with the specified hostname could not be found”;
• “Pairing error” when scanning a QR code;
• “Your Internet connection may have been interrupted”;
• “Could not resolve host”;
• The app constantly shows “Connection”, “blocked by CORS policy” in the developer console.

Are You Working on a Corporate Network with Restrictions?

Make sure that all required network accesses are open and that eXpress is not blocked on your network. More details.

Connection Problem or Interference?

• For eXpress to function properly, you need to ensure sufficient internet speed and low ping. More details.
• On mobile, switch between Wi-Fi and mobile data (LTE) or disable “Airplane mode”.
• Try tethering from another device or using a different ISP.
• Disable VPN, ViPNet, proxy, firewall, or antivirus. Add the app to exceptions. Check and grant required network access.
• In the browser, grant the site Access to the Local Network permission and reload the page. Disable browser extensions or proxies (e.g., friGate) that may affect traffic. If the web app fails to connect only when VPN is enabled — see “Browser Restrictions in the Web App”.

Are the Required Certificates Not Installed?

The common reason for sign-in errors on a mobile device is missing Russian Trusted Root CA certificates (Ministry of Digital Development, if your organization uses them). Install them according to the instructions, then fully close the app and start it again.

If your organization uses a third-party certificate, install it (contact your organization's support team or eXpress).

For Administrators: Registration Method and Certificate Diagnostics

Open the following link in the user’s and your browser:

https://server_address/api/v2/ad_integration/register_methods

• If the link fails only for the user, check their VPN, ViPNet, proxy, antivirus, or browser extensions. Ensure required network access is granted. In the web app, check the browser console (Fn + F12 > Console tab) for errors.
• If the browser reports certificate issues, check the certificate.
• If register_metod_not_set appears, select a registration method and sync source in the admin panel (Registration Settings), then click Save.

For Administrators: Desktop Client Misconfiguration

In organizations with restricted internet access, the desktop client settings must specify the correct hostname matching the proxied web app.

Still Not Working?

• Wait a few minutes and try again.
• If unresolved, collect login logs and contact your organization’s support team or eXpress support.

For Administrators: Incorrect Number of CTS Encryption Keys

Lite

CTS

eCTS

1. Open the web app and browser console (Fn + F12 > Console tab). Look for a 400 response to the register_confirm request.
2. On the server, collect ad_integration service logs. Look for entries like:
   

   
   2021-10-19T12:52:34.998418907Z 2021-10-19 12:52:34.991 request_id=Fq9vp4IcJ-0j9u0AiWUB [info] POST /api/v1/ad_integration/register_confirm
   2021-10-19T12:52:35.138010731Z 2021-10-19 12:52:35.133 [error] The number of cts keys isn't one: []
   2021-10-19T12:52:35.142127307Z 2021-10-19 12:52:35.133 request_id=Fq9vp4IcJ-0j9u0AiWUB [info] AdIntegrationWeb.Api.RegistrationController.register_confirm error: %ApiController.Error{code: 400, error_data: %{}, errors: [], reason: :keys_error}
               

3. Resetting the user’s encryption key password will help generate new keys. ⚠️ Correspondence will be lost!

“Corporate Email Not Found” Error After Entering Email

Logging In Via Corporate Email?

You selected sign-in via corporate email on the first screen. Check if the email is entered correctly, choose another sign-in method, or contact your organization’s support team or eXpress support to set up simplified authentication for automatic server discovery.

Trying to Get Code via Email?

The error appeared on the email confirmation screen. Make sure the address is entered correctly or contact your organization’s support.

Error “The entered email does not meet server requirements” After Entering Email

The email address you entered doesn't match the regular expression set by your administrator in the email mask for self-registration. Contact your organization's support team to find out which email address you need to enter.

“Corporate Server Address Not Found” Error After Entering Server Address

Check if the address is entered correctly, whether there are any network issues, or contact your organization’s support team or eXpress support.

For Administrators: Diagnosing Server Address Errors

Additional possible causes:

• The server software version is below 3.13.
• The registration type is not specified in the Registration Settings section of the admin panel.

“Please Use a Special Application…”, “Please Use Other Application Version…” Errors

Logging Into the Wrong Application?

You are trying to connect to an eXpress corporate server ( or ), but your account is linked to an app server, or vice versa.

What to Do?

• If you work for this organization, install its app: the name and installation link will be provided by your organization’s support.
• If you no longer work for the organization, you need to log out from its corporate server. The request is submitted through the organization’s support or system administrators; after logging out, the number will be released, and you will be able to log into regular eXpress. If you cannot contact your previous organization, contact eXpress support — we will forward the request.
• If you cannot get the log-out, the only remaining option is to register in eXpress with a different phone number.

For Administrators: Unable to Sign In after Changing from One ETS to Another

ETS

If a user switched from one

ETS

app to another but the old ETS ID is displayed in the profile, follow these steps:

Method 1: Direct Database Update

If you have database access, run the command:

ets_phonebook_prod=# update users set ets_id = null where huid = 'USER_HUID';

Method 2: Console Commands (If Database Is Unavailable)

1. Access the ets_phonebook_1 console:
   docker exec -it ets_phonebook_1 sh ./bin/ets_phonebook remote
   or:
   dpl --dc exec phonebook sh ./bin/ets_phonebook remote
   ⚠️ Pre-3.43 server versions require remote_console command instead of remote.
2. Run the code:
   defmodule ETSPhonebookWeb.ClearIds do use ETSPhonebookWeb, :command alias ETSPhonebook.Models.User alias ETSPhonebook.Queries.UsersQueries alias ETSPhonebook.Repo def execute(huid) do with {:ok, user} <- UsersQueries.by_huid(huid), {:ok, _} <- update_local_user(user) do :ok end end defp update_local_user(user) do user |> User.changeset(%{cts_id: nil, ets_id: nil}) |> Repo.update() end end
3. Apply the changes:
   ETSPhonebookWeb.ClearIds.execute("USER_HUID")

Note: This issue is fixed in server software version 3.9.

Is Your Account Connected to Another Server?

You changed jobs, and your previous employer did not log out of your account on the old server. Contact them or eXpress support. For details, see who performs the logout.

Trying to Use Phone Login When You Registered Without One?

You are trying to sign in without a phone number, but the administrator has prohibited such sign-ins. For details, see sign-in with a phone number required.

Email Verification Code Not Received

If the verification code isn't delivered to your email, first check your “Spam” folder. If the message is missing or multiple colleagues experience the same issue, contact your organization's support to verify corporate server email settings.

To Administrator: Email Delivery Verification

Check email delivery in the E-mail section of the admin panel. If test emails fail to arrive, verify configuration for both sender and recipient mailboxes.

Also try sending an email to this user from the mailbox that the backend uses to send emails. Do not use the eXpress administrator panel; use another method instead (access that mailbox directly through an email client).

• Did the email arrive? The issue is on the corporate server side.
• Did the email not arrive? Check what is blocking emails in your mail system.

"cts_registration_not_supported” Error When Logging in via QR Code

The issue is related to the corporate server. Contact your organization’s support team or eXpress support to restore the server.

“Connection error, please contact your administrator” Error When Logging in via Email or Server Address

Contact your organization’s support team to update the app's server part to the latest version. Until updated, only phone number or QR code login is available.

“Can't read RTS keys” Error When Logging in via QR Code from iOS to Web/Desktop App

The mobile app uses incorrect keys due to outdated version or login issue.

How to Resolve This?

1. Close the session in the iOS app.
2. Log in to the iOS app again (without QR code).
3. Retry logging in to the web/desktop app via QR code.

“Error while connecting to Active Directory via NTLM”

The issue is caused by group policy settings. Contact your organization’s support team.

For Administrators: Configuring Group Policy or Changing Registration Method

If the NTLMv2-related error occurs on different devices, do one of the following:

• In the domain group policies, clear the Require NTLMv2 Session Security checkbox.
• Or change the registration method from NTLM to Email in the corporate server settings.

“Request_invalid_signature” Or “Set the Correct Time”

The error occurs due to incorrect time settings on the device.

Setting Time Didn't Help?

Sometimes the error is caused by lacking a connection from to or from to . Contact your organization's support so they can try reconnecting from / to /, if adjusting the time settings on your device did not help.

“SSL Error”, “Server Connection Error”, “Connection Error” on Android When Entering Phone Number, Email, or Server Address

Update the app. If that doesn’t help, contact your organization’s support team or eXpress support.

The App is Up to Date?

Ask your organization's support for help. For Administrators: Check the certificate.

“Authentication error. Please try again later” When Scanning QR Code

If phone number login works but QR code login doesn’t, contact your organization’s support team to check the server.

For Administrators: Check Registration Attempt Limit

Request web/desktop app logs from the user. For the registration_confirm_attempts_exceeded error in the admin panel:

• Go to Registration Settings > Email.
• Ensure the Maximum Attempts field is set to at least 5.

If the field is empty, the default is 3 attempts.

Unexpected Session Logoff or Redirect to Login Screen

Was Cache Cleared?

Clearing browser cache (in web app), Android app cache, or deleting credential keys (Windows) or keychain items (macOS, Linux) in desktop version may log you out of session.

Connecting to Remote Workplace?

Use VDI after additional configuration.

Did You Tap “Forgot PIN Code?”

The Forgot PIN code? button on the PIN entry screen not only resets the code but also ends the current session — no data is lost; you will just need to sign in again. Learn more.

Did You Receive a Push Notification About Session Termination?

If a session ended due to OpenID (Keycloak) issues, starting from server version 3.12, a push notification about this may arrive on the mobile device — this is expected behavior, not a sign of a security breach. Tapping the notification opens the sign-in screen.

Still Not Working?

If the issue persists, contact your organization’s support team or eXpress support.

For Administrators: Diagnosing Unexpected Session Termination

CTS

eCTS

Check the following:

• Whether the cache on client computers is being cleared, and whether VDI folder persistence is configured.
• Events in the “Audit” section of the admin panel. If the session was ended by the user, it will appear in their activation (the Activations section) as closed_by_user_request.
• Active Directory synchronization settings or OpenID — for example, a password change, removal from a group, or exclusion from the synchronization filter (excluded_from_search_filter) can automatically create a logout request. For the full list of reasons, see the admin panel, “Logout Requests” section.
• The lifetime of activations in the “Activations” section of the admin panel.
• The expiration period of the OpenID access token. For example, if for some reason the OpenID offline token could not be refreshed, the corresponding user session will end. In the corresponding user activation in the admin panel, the session block reason openid_offline_session_invalid will be specified.
• Keycloak availability. If the OpenID server is briefly unavailable, the client may end sessions for users whose token required refresh at that moment. Until availability is restored, you can temporarily switch the registration method to another one, such as email.

What happens to the user in the period before the request is confirmed and after logout — see the article “Corporate Account Logout”.

Profile Creation Error | “Cannot Decrypt RTS Access Token” Error

If an error occurs after logging into the corporate server in the web or desktop app, and the message “Creating profile error” appears on Android, the account requires correction on the server. Contact your organization’s support team or eXpress support.

For Administrators: Fixing RTS ID

The error may occur if:

• the user registered on the Russian
  RTS
  and then changed the country in the web app;
• the user registered on a foreign
  RTS
  but is trying to log in from a mobile device.

In this case, the registration request may be sent to the wrong

RTS

where the initial registration took place. The logs display the error:
{ "error_data": {}, "errors": [ "Cannot decrypt RTS access token" ], "reason": "request_invalid_signature", "status": "error" }
Solution: update the user’s rts_id on

CTS

by specifying the value from their personal account on

RTS

. To do this:

• Confirm the user’s rts_id with eXpress support.
• Run the following commands in the console: cd /opt/express dpl --dc exec postgres psql -U postgres \c ad_phonebook_prod update users set rts_id = 'required_rts_id' where huid = 'user_HUID';

Note: the issue is resolved in version 3.22 of the server and client software.

Warning “Add a Telephone Number: The Administrator has Prohibited Login without a Telephone Number”

If this message appears when logging into the app:

• add a phone number to the profile;
• or contact your administrator (via your organization’s support) — the requirement may need to be disabled in the server settings.

Errors “An Error has Occurred. Try Again Later” | “Number of Attempts to Send Code Exceeded” | “Confirmation limit exceeded” (Email Code)

The daily limit for sending email codes from your IP address has been exceeded. The authentication logs display the max_failed_email_sending_attempts_reached error.

How to Resolve This?

Try again in 24 hours or contact your organization's support team so the administrator can manually remove the lock.