Error: Only controllers of canister can call ic00 method install_code

I am trying to upgrade code on a canister already deployed to the ic. I have my canister_ids.json file in the same folder so it knows to upgrade and not redeploy from scratch, and I run:

dfx deploy --network ic

However, when it attempts to install the code, I get the error

Http Error: status 403 Forbidden, content type "application/cbor", content: Only controllers of canister <canister id> can call ic00 method install_code

However, I am the controller of the canister, since my principal id is tied to my device and I deployed the canister from the same device. What is the issue?

EDIT: The answer here Canister's controllers: Error in deployment does not work in my case, since I am deploying via a wallet obtained via the faucet.

EDIT 2: My belief is that this is an upgrade issue. I upgraded dfx recently. I tried to deploy to the network ic from scratch (i.e didnt try to upgrade an existing canister but created new ones). And I got the same error. That is, dfx deploy --network ic is no longer working for a new standalone Dapp, whereas it used to work perfectly before. This is a serious issue now and I do not know how to resolve it. I cant even throw tokens at the problem to get my Dapp running. (I should remark here that I upgraded dfx by running the installation curl command again – in retrospect, this is possibly the wrong way to do it and I should have instead ran dfx upgrade. Could this have created some kind of “duplicate” that is confusing the IC – i.e is it creating canisters from one id? and trying to upgrade it with a different id? – however, the wallet id has not changed, so I dont see how this can happen).

Thanks in advance.

1 Like

I just ran into this same issue. Did a “dfx deploy --network ic” to deploy a new project to the IC for the first time, it created the canisters but won’t let me deploy to them as it didn’t set my principal id as a controller on it. I’m on dfx version 0.9.2 and haven’t done an upgrade since creating the new project. And the wallet is from the faucet.

When I get the info of the canister created, the controller is my wallet id. For canisters of other projects I’ve successfully deployed the canister info show my identity principal as the controller.

Any thoughts on what’s happening and how to resolve?


1 Like

ok so it looks like doing the below lets me deploy successfully.

dfx deploy --wallet “$(dfx identity get-wallet)”

The previous way seemed easier. Maybe something can be added to the help text of the deploy command, as it’s not clear this is required. Also seems like a bug that it was able to create the canisters but not install to the canister within the same initial dfx deploy call. I’d think it would use the same permissions/id for creating the canister and installing on the canister.

Ignore my previous solution, I realized I didn’t deploy to the ic, when I added --network ic I get an error that says:
Canister has no update method ‘wallet_call’"

We’ve had some issues with the faucet installing outdated wallet versions. Can you try to upgrade your wallet (dfx wallet --network ic upgrade) and then try again?

Also, to fix the need for --wallet <wallet id> you can run dfx canister --network ic --wallet "$(dfx identity --network ic get-wallet)" update-settings --all --add-controller "$(dfx identity get-principal)". This will add your own principal to the canisters’ controllers so you don’t have to proxy your calls through the wallet anymore.

A better error message for this instance is planned.


Thanks @Severin, upgrading the wallet and then adding the principal did the trick.

Thank you so much Severin – this fixed the problem! The outdated wallet version was indeed the issue.