Secure ADB 'espercli secureadb connect' fails: check user role permissions

Android

If you're getting an "Issue in reaching Esper API Service" error when running espercli secureadb connect, the problem is likely your user role permissions, not your tenant configuration. This article explains how to fix it.

Understanding the error

When you run espercli secureadb connect, you may see this error:

Issue in reaching Esper API Service for connection negotiation

This error occurs when your user account is assigned a role that doesn't include permission to manage Secure Remote ADB sessions. The Esper API enforces role-based access control (RBAC) and rejects session requests from users without the required permissions.

This is a permissions issue, not a tenant-level configuration problem. Your tenant has Secure Remote ADB enabled by default.

Before you begin

You need to be an Enterprise Admin (or have role management privileges) to update user permissions.

How to fix this

1. Log in to the Esper Console as an Enterprise Admin.
2. Navigate to Company Settings → Roles (the exact path may vary depending on your console version).
3. Find the custom role assigned to the user who's having the issue.
4. Click to edit that role and enable these permissions:
   • Secure Remote ADB — allows initiating and managing ADB sessions
   • Device Log / Event File Download — if the user also needs to download logs via API
5. Save the role changes.
6. The affected user does not need to regenerate their API key — the updated permissions take effect immediately.
7. Have the user run espercli secureadb connect <device-id> again. The command should now succeed.

Key points about API keys and roles

API key scopes and user role permissions are separate mechanisms:

• An API key must have the appropriate OAuth scope (for example, device management access)
• The user account that created the key must have the required role permissions
• Both must be correctly configured for Secure ADB to work

If the role permission is missing, the API will reject the request regardless of the key's scope.

Troubleshooting: if the error persists

• Verify the API key belongs to the correct account. API keys are scoped to the user who created them. If the key was created under a different user account than the one whose role you updated, regenerate a new key under the correct account.
• Confirm the role permissions were saved. Navigate back to the role to double-check that the "Secure Remote ADB" permission is enabled.
• Check custom roles haven't been missed. When Esper adds new permission types to the platform, custom roles (non-default roles) do not automatically inherit them. You must manually add new permissions to existing custom roles.

Still need help?

If you've verified the role permissions and the error continues, or if you need help identifying your Enterprise Admin contact Esper Support.