# invalid_credentials

The email address and password, or the passkey, did not verify (401).

## Meaning

`POST /v1/auth/sign-in` answers this for a wrong password, for an email address no
account holds, and, while `auth.brute_force.reveal_lockout` is off, for the right
password of an account an administrator suspended or blocked. A passwordless passkey
sign-in answers it for every refusal: an unknown credential, a bad signature, or an
account that may not sign in. The answer is the same in each case, so it does not
say whether an account exists.

## Impact

The user stays on the sign-in screen with an error. A single occurrence is expected:
people mistype passwords. A run of them for one address or from one address is
password guessing, which the brute-force throttle, the captcha and the account lock
then answer.

## Diagnosis

1. Look the request id up on the dashboard's Troubleshooting page. The attempt is
   recorded as `auth.sign_in.completed` with reason `invalid_credentials` and a cause
   such as `password_mismatch` or `unknown_identifier`; a suspended or blocked
   account is recorded with reason `account_unavailable`. Only administrators with
   `audit.read` see it; the response itself never says.
2. `nauthera_auth_logins_total{result="invalid"}` shows the rate across the fleet.
3. A spike from few addresses is guessing; check the threat page of the dashboard.

## Mitigation

- As a user: check the address and password, or use "Forgot password" to set a new
  one. If you were told your account was suspended, contact the administrator.
- As a client developer: nothing to do; the hosted sign-in UI handles it.
- As an operator or support agent: confirm on the Troubleshooting page what the
  record says, and answer the user without telling a third party whether an account
  exists. Reactivate a suspended account only through the admin API or dashboard.

## Escalation

Escalate when a user with the right password is refused and the record shows no
suspension or block, or when the rate jumps fleet-wide after an upgrade. Open an
issue with the request id, the record's reason and cause, and the server version.
Never attach the password or the email address in a public issue.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.