Help
How-to topics on top, then the error code reference. Search works across both.
Topics
Agent tokens
Issue, rotate, and revoke agent tokens for the CLI / MCP / SSH.
Audit log and retention
Audit log fields, sample events (push, agent tool call), retention by tier.
Getting started
Account setup, passkeys, SSH, GitHub import, first repo, orgs, agent tokens.
Two-factor authentication
Enrol TOTP, save recovery codes, navigate step-up, recover.
OAuth apps
Register an OAuth client; redirect-URI rules; scopes; secret rotation.
Organizations
Create an org, invite members, transfer ownership, soft-delete.
Privacy
Telemetry opt-out, data export, account deletion.
Repositories
Create, clone, push; soft-delete + 30-day undo + purge window.
SCIM provisioning
SCIM 2.0 user and group provisioning: create, update, deprovision via your IdP.
Searching
Cmd-K palette, in-repo symbol search, mention autocomplete.
Self-hosting
Run Citadel on your own infrastructure; offline Ed25519 license verification, no phone-home.
SSH keys
Generate, upload, and verify SSH keys for git over port 22.
Error reference
E-client_is_public
Public clients have no secret to rotate.
E-display_name_too_long
Display name must be 80 characters or fewer.
E-identity_already_linked
That provider account is already linked to a different Citadel account.
E-identity_email_mismatch
The provider returned a different email than the one on your Citadel account.
E-identity_link_failed
The link couldn't be completed.
E-identity_provider_unavailable
That provider isn't available right now.
E-invalid_email
That doesn't look like a valid email address.
E-invalid_format
Username can only contain letters, digits, and hyphens.
E-invalid_redirect_uri
A redirect URI is invalid.
E-is_public_immutable
Public/confidential cannot be changed after creation.
E-name_required
Name is required.
E-rate_limited
Too many sign-in attempts.
E-redirect_uris_required
At least one redirect URI is required.
E-reserved
That username is reserved by Citadel.
E-slug_taken
Someone took that name a moment ago.
E-too_long
Username must be at most 39 characters.
E-too_short
Username must be at least 3 characters.
E-unknown_provider
That provider isn't enabled.