Company cards - Error shows up after clicking Assign new cards

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.40-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #84313
Email or phone of affected tester (no customers): sjodijsndosjosjd@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.2 / Chrome
App Component: Workspace Settings

Action Performed:

1. Go to staging.new.expensify.com
2. Create a new account. Do not validate account.
3. Create workspace.
4. Go to workspace settings > Company cards.
5. Add Wells Fargo direct feed.
6. Click Settings > Assign new cards.

Expected Result:

Bank auth will open.

Actual Result:

Error shows up.

"Due to a high number of login attempts, this option has been disabled for 24 hours. Please try again later or enter details manually instead."

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Video.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @fedirjh

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #84313

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Backend bug
Causing PR: #84313 - "Add Assign new cards option for direct card feeds" by @fedirjh (High confidence)
Related Issues: None

Recommendation: NEEDS INVESTIGATION

The error appears immediately when clicking "Assign new cards" without the Plaid modal even opening, which indicates the backend is returning IS_PLAID_DISABLED: true before any login attempt occurs. This suggests a backend issue with how the refresh card feed flow handles unvalidated accounts, rather than an issue with the App code itself.

Labels: Removing DeployBlockerCash (backend issue, no App changes needed)

Detailed Analysis

Evidence

PR #84313 introduced the "Assign new cards" feature which allows users to refresh their card feed connection by triggering a Plaid re-authentication flow. The feature was merged on March 17, 2026.

The error message "Due to a high number of login attempts, this option has been disabled for 24 hours" appears immediately when clicking "Assign new cards", before the user can even attempt to enter credentials.

Verification

The relevant code flow:

1. User clicks "Assign new cards" in WorkspaceCompanyCardsSettingsPage
2. Navigates to RefreshCardFeedConnectionPage
3. Shows PlaidConnectionStep which calls openPlaidCompanyCardLogin() API
4. PlaidConnectionStep checks IS_PLAID_DISABLED Onyx key (line 45)
5. If true, shows error message (line 235)

Key files modified by PR #84313:

• src/pages/workspace/companyCards/addNew/PlaidConnectionStep.tsx - Added isRefreshConnectionFlow prop
• src/pages/workspace/companyCards/RefreshCardFeedConnectionPage.tsx - New page for refresh flow
• src/pages/workspace/companyCards/WorkspaceCompanyCardsSettingsPage.tsx - Added "Assign new cards" menu item

Root Cause

The IS_PLAID_DISABLED flag is controlled by the backend via the HANDLE_RESTRICTED_EVENT API. The flag is being set to true for unvalidated accounts or there is a backend bug causing it to be incorrectly set when calling openPlaidCompanyCardLogin() for the refresh flow.

Since:

• The error appears before any user interaction with Plaid (no modal is shown)
• The issue is reproducible only with unvalidated accounts
• The frontend code correctly checks the flag and displays the appropriate error
• No frontend code can fix this as the restriction is coming from the backend

This is a backend issue where the API needs to be fixed to:

1. Not pre-emptively disable Plaid for unvalidated accounts in the refresh flow, OR
2. Return a more appropriate error message indicating account validation is required, OR
3. Fix the backend logic that incorrectly sets IS_PLAID_DISABLED

The App code is functioning correctly - it is properly displaying the error returned by the backend.

[hungvu193]

I think this is expected to prevent spaming