diff --git a/sandboxes/capacity.mdx b/sandboxes/capacity.mdx
index 256a3d2a..9e9403ea 100644
--- a/sandboxes/capacity.mdx
+++ b/sandboxes/capacity.mdx
@@ -1,5 +1,5 @@
 ---
-title: "Sandbox Capacity"
+title: "Sandboxes Capacity"
 description: "Raise the sandbox node group's CPU limit and tune the warm pod pool to run more sandboxes"
 ---
 
diff --git a/sandboxes/getting-started.mdx b/sandboxes/getting-started.mdx
index f47b4f3c..5ebeb9c7 100644
--- a/sandboxes/getting-started.mdx
+++ b/sandboxes/getting-started.mdx
@@ -69,6 +69,10 @@ To point the SDK at a specific URL instead, set `PORTER_SANDBOX_BASE_URL` or pas
 
 ## Python quickstart
 
+<Note>
+**Authentication**: when your code runs as a Porter Application in the same cluster where sandboxes are enabled, the SDK authenticates automatically and the quickstarts below work as-is. To run them from anywhere else (a local machine, CI, another cluster), first set `PORTER_SANDBOX_API_KEY` and `PORTER_CLUSTER_ID` as described in [Calling from outside the cluster](#calling-from-outside-the-cluster).
+</Note>
+
 Install the SDK in your application image:
 
 ```bash
@@ -317,6 +321,12 @@ sandbox = porter.sandboxes.create(
 )
 ```
 
+## Troubleshooting
+
+- **`exec` fails because the sandbox already exited**: a sandbox only accepts `exec` while its main process is running. An image whose default command exits immediately moves to `succeeded` within a few seconds and stops accepting exec calls. Give the sandbox a long-running main process so you can exec into it — see [Keep a sandbox alive for exec](#keep-a-sandbox-alive-for-exec).
+- **Authentication errors when running outside the cluster**: make sure `PORTER_SANDBOX_API_KEY` (a Porter API token with developer permissions) and `PORTER_CLUSTER_ID` are set — see [Calling from outside the cluster](#calling-from-outside-the-cluster).
+- **Full error reference**: every error class the SDKs raise is documented in the [Python SDK errors](/sandboxes/sdk/python/errors) and [TypeScript SDK errors](/sandboxes/sdk/typescript/errors) pages.
+
 ## Next steps
 
 - Use [Sandbox Networking](/sandboxes/networking) to serve sandboxes over HTTPS on your own domains.
diff --git a/sandboxes/networking.mdx b/sandboxes/networking.mdx
index 3fb39589..38783d63 100644
--- a/sandboxes/networking.mdx
+++ b/sandboxes/networking.mdx
@@ -1,5 +1,5 @@
 ---
-title: "Sandbox Networking"
+title: "Sandboxes Networking"
 description: "Serve sandboxes over HTTPS on your own domains and restrict their outbound traffic with egress allowlists"
 ---