# too_many_attempts

An attempt budget is spent; retrying cannot help, start over (429).

## Meaning

The device flow's code entry (`/v1/auth/device/verify`) allows five wrong user codes
per signed-in user (RFC 8628 §5.1). After that, entry is refused with this code. It
differs from `too_many_requests`: the flow is over rather than slowed down.

## Impact

The user cannot finish signing in the device with this attempt. The device itself
then sees `access_denied` on its poll when a real session was ended. It is rare for
a legitimate user; a run of them suggests someone guessing codes.

## Diagnosis

Look the request id up on the Troubleshooting page. Each wrong code is recorded as
`oauth.device.user_code.attempted` with `attempts` and `remaining`, and the spent
budget as `auth.rate_limit.triggered` with `limit_scope` `device_user_code`;
`session_ended` says whether a live device session was ended.

## Mitigation

- As a user: start the sign-in again on the device to get a new code, and type it
  carefully.
- As a client developer: on `access_denied`, start a new device authorization.

## Escalation

Escalate when users hit it without typing wrong codes. Open an issue with the request
id, the `oauth.device.user_code.attempted` records and the server version. Never
attach the device or user code.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.