too_many_attempts
Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program
An attempt budget is spent; retrying cannot help, start over (429).
Meaning
The device flow's code entry (/v1/auth/device/verify) allows five wrong user codes
per signed-in user (RFC 8628 §5.1). After that, entry is refused with this code. It
differs from too_many_requests: the flow is over rather than slowed down.
Impact
The user cannot finish signing in the device with this attempt. The device itself
then sees access_denied on its poll when a real session was ended. It is rare for
a legitimate user; a run of them suggests someone guessing codes.
Diagnosis
Look the request id up on the Troubleshooting page. Each wrong code is recorded as
oauth. with attempts and remaining, and the spent
budget as auth. with limit_scope device_user_code;
session_ended says whether a live device session was ended.
Mitigation
- As a user: start the sign-in again on the device to get a new code, and type it carefully.
- As a client developer: on
access_denied, start a new device authorization.
Escalation
Escalate when users hit it without typing wrong codes. Open an issue with the request
id, the oauth. records and the server version. Never
attach the device or user code.
Problem code runbooks · Generated from internal/ in nauthera-server.