Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

invalid_credentials

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The email address and password, or the passkey, did not verify (401).

Meaning

POST /v1/auth/sign-in answers this for a wrong password, for an email address no account holds, and, while auth.brute_force.reveal_lockout is off, for the right password of an account an administrator suspended or blocked. A passwordless passkey sign-in answers it for every refusal: an unknown credential, a bad signature, or an account that may not sign in. The answer is the same in each case, so it does not say whether an account exists.

Impact

The user stays on the sign-in screen with an error. A single occurrence is expected: people mistype passwords. A run of them for one address or from one address is password guessing, which the brute-force throttle, the captcha and the account lock then answer.

Diagnosis

  1. Look the request id up on the dashboard's Troubleshooting page. The attempt is recorded as auth.sign_in.completed with reason invalid_credentials and a cause such as password_mismatch or unknown_identifier; a suspended or blocked account is recorded with reason account_unavailable. Only administrators with audit.read see it; the response itself never says.
  2. nauthera_auth_logins_total{result="invalid"} shows the rate across the fleet.
  3. A spike from few addresses is guessing; check the threat page of the dashboard.

Mitigation

  • As a user: check the address and password, or use "Forgot password" to set a new one. If you were told your account was suspended, contact the administrator.
  • As a client developer: nothing to do; the hosted sign-in UI handles it.
  • As an operator or support agent: confirm on the Troubleshooting page what the record says, and answer the user without telling a third party whether an account exists. Reactivate a suspended account only through the admin API or dashboard.

Escalation

Escalate when a user with the right password is refused and the record shows no suspension or block, or when the rate jumps fleet-wide after an upgrade. Open an issue with the request id, the record's reason and cause, and the server version. Never attach the password or the email address in a public issue.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.