Sign-in help

Every time a moderator signs in, Waterhole checks that the Mastodon server answering for your instance's domain is still the one that signed up here. A domain can change hands, and whoever runs it next must not see your team's applicants and notes. That check is behind everything on this page.

Mastodon asks me to authorize Waterhole again

That is expected, once. Waterhole now also asks for permission to search: it uses it to have your server fetch a page from Waterhole, which your server signs with a key only it holds. That signature is how Waterhole tells your server apart from anyone else who might later get your domain. Waterhole does not search anything else with it.

Approve it as before; after that, signing in works as it always did.

I declined Waterhole's request on Mastodon

Nothing happened: Waterhole got no access, and what it had before is unchanged. To sign in, start again and approve the request.

Being careful was right. A genuine request:

starts on this Waterhole's sign-in page, at waterhole.toot.io;
is shown on your own server's address, where you are signed in to Mastodon;
names the app Waterhole and asks for your profile, search, and managing accounts as a moderator.

If something about it still looks wrong, ask an administrator of your instance before approving it.

Waterhole is listed twice among my authorized apps

Asking for the new permission meant registering Waterhole with your server again, and Mastodon keeps the old authorization until you revoke it. Waterhole no longer uses the older entry, so revoking it changes nothing here. In Mastodon it is under Preferences → Account → Authorized apps.

“… could not prove it is the server that signed up here”

Your server was asked to fetch a page from Waterhole and sign it, and no correctly signed fetch arrived. Nothing you did causes this, and trying again rarely helps. The usual causes:

Your server cannot reach this Waterhole: a firewall on its outgoing traffic, or this Waterhole's domain blocked on your server.
Something in front of this Waterhole changes the request on the way, so the signature no longer matches.
Your domain now points to a different Mastodon server than the one that signed up. Then this is the check doing its job.

An administrator of your instance can check the first and the last; the operator of this Waterhole the second (contact details).

“Could not reach … /actor …”

Waterhole reads your server's public key from its instance actor, at /actor on your domain, before sending you to sign in. Every Mastodon server publishes one. If it could not be read, the server was unreachable or something other than Mastodon answered; an administrator of your instance can check what the address shows.