This issue is resolved.

We recently made a change in how we connect to 3rd party servers during our SSO process, which caused problems with some servers - specifically if their domain resolved to multiple IP addresses.

There is an issue logging in with SSO for users using Okta with OIDC.

We are investigating the issue and will update with a resolution once we have one.

We've deployed a fix for a login issue that may have affected some Desktop and Web Extension users.

When you sign in, we reuse your existing authentication token if it's still valid rather than issuing a new one. We had recently rotated the signing key used for these tokens. Our reuse check confirmed the token hadn't expired — but it didn't re-verify the signature against the new key, so we handed back a token that was still signed with the old key. After the login flow redirected back to the app, the app called the server to verify that token, and verification failed.

The fix re-verifies a token's signature before reusing it and issues a fresh token whenever the existing one no longer validates, so sign-in now recovers automatically. No action is needed beyond signing in again.

We also identified that our error messaging in this area wasn't clear, and we're making improvements there in a future release.

We have identified the root cause and are working on deploying a hotfix.

The issue and fix are on our server, updating to a later desktop version is not required.

Windows desktop users are unable to login and receive the following error message:

Unexpected response shape from server (status 401).

We are investigating the issue and will update with a resolution as soon as possible.