| disallowed_useragent |
Google OAuth: Error 403: disallowed_useragent (sign-in from an embedded WebView) |
Google blocks OAuth sign-in inside embedded WebViews (in-app browsers, Electron BrowserWindow, React Native W… |
| redirect_uri_mismatch |
OAuth Error: redirect_uri_mismatch |
The redirect URI in your OAuth request doesn’t exactly match one registered for the client in the provider’s… |
| invalid_token |
invalid_token: The access token is invalid (JsonWebTokenError: invalid signature / jwt malformed) |
A token was sent but the server couldn’t verify it — bad signature, malformed, revoked, or issued for another… |
| auth/too-many-requests |
Firebase Auth: auth/too-many-requests — Access to this account has been temporarily disabled due to many failed login attempts |
Firebase throttled sign-in or SMS verification because of too many attempts from the device/IP or for the acc… |
| Google hasn't verified this app |
Google OAuth: Google hasn't verified this app / This app isn't verified |
The OAuth app requests sensitive or restricted scopes and hasn’t passed Google’s verification, so users see a… |
| Access blocked: has not completed the Google verification process |
Google OAuth: Error 403: access_denied — The developer hasn't given you access to this app / has not completed the Google verification process |
The Google OAuth app is in “Testing” publishing status and the signing-in account isn’t listed as a test user. |
| access_denied |
OAuth 2.0 Error: access_denied (The user or authorization server denied the request) |
The authorization request was refused — the user clicked Cancel/Deny on the consent screen, or a policy denie… |
| Account is not fully set up |
Keycloak: invalid_grant — Account is not fully set up |
The user has pending required actions (verify email, update password, configure OTP), so non-interactive toke… |
| invalid_grant |
OAuth 2.0 Error: invalid_grant |
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already… |
| login_required |
OIDC Error: login_required / interaction_required / consent_required (silent authentication failed) |
A silent sign-in (prompt=none, iframe or refresh) couldn’t complete because the user must interact — no sessi… |
| Missing Authentication Token |
{"message":"Missing Authentication Token"} / No authorization token was found |
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method t… |
| PKCE verification failed |
OAuth PKCE error: invalid_grant — PKCE verification failed / code_verifier does not match code_challenge / code_challenge required |
The code_verifier sent to the token endpoint doesn’t match the code_challenge from the authorize request, or… |
| NotAuthorizedException |
AWS Cognito: NotAuthorizedException: Incorrect username or password |
Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client… |
| OAuthAccountNotLinked |
NextAuth / Auth.js: OAuthAccountNotLinked — To confirm your identity, sign in with the same account you used originally |
A user tried to sign in with a new OAuth provider using an email that already belongs to an account created w… |
| secretOrPrivateKey must have a value |
Error: secretOrPrivateKey must have a value (jsonwebtoken sign) |
jwt.sign() got an empty secret — the environment variable holding the JWT secret isn’t loaded. |
| auth/network-request-failed |
Firebase Auth: auth/network-request-failed — A network AuthError (such as timeout, interrupted connection or unreachable host) has occurred |
The Firebase Auth SDK couldn’t reach Google’s servers — offline, blocked by an extension/firewall, or (on And… |
| bad_verification_code |
GitHub OAuth: {"error":"bad_verification_code","error_description":"The code passed is incorrect or expired."} |
The authorization code sent to GitHub’s token endpoint was already used, expired (10 minutes), or belongs to… |
| invalid_request |
OAuth 2.0 Error: invalid_request (missing or invalid parameter) |
The authorization or token request is malformed — a required parameter is missing, duplicated, or has an inva… |
| invalid_scope |
OAuth 2.0 Error: invalid_scope / insufficient_scope |
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint… |
| Failed to serialize user into session |
Passport.js: Error: Failed to serialize user into session |
Passport logged a user in but there’s no serializeUser function (or it didn’t call done), so the session can’… |
| invalid two-factor code |
Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift) |
The 6-digit authenticator code is rejected — usually because the phone’s or server’s clock is off, or the sec… |
| NotAllowedError (WebAuthn) |
WebAuthn / Passkeys: NotAllowedError: The operation either timed out or was not allowed |
The browser refused the passkey/WebAuthn ceremony — the user cancelled, it timed out, no matching credential,… |
| Unable to verify secret hash for client |
AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x |
The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrong… |
| auth/invalid-credential |
Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) |
Firebase rejected the email/password sign-in — wrong password, no such user, or a provider credential that’s… |
| Invalid parameter: redirect_uri |
Keycloak: We are sorry... Invalid parameter: redirect_uri |
The redirect_uri in the login request isn’t in the Keycloak client’s Valid Redirect URIs. |
| invalid_client |
OAuth 2.0 Error: invalid_client |
The OAuth server couldn’t authenticate your application — wrong client ID/secret, wrong auth method, or the c… |
| nonce mismatch |
OIDC Error: nonce mismatch / ID token nonce did not match / unexpected nonce |
The nonce inside the ID token doesn’t match the one the app stored — the replay protection check failed. |
| PERMISSION_DENIED |
PERMISSION_DENIED: The caller does not have permission (insufficient permissions) |
You are authenticated, but your identity isn’t allowed to perform this action on this resource. |
| SAML response invalid |
SAML: Invalid SAML response — signature validation failed / audience mismatch / response expired (NotOnOrAfter) |
The service provider rejected the IdP’s SAML assertion — wrong certificate, Audience/Entity ID mismatch, ACS… |
| Email not confirmed |
Supabase Auth: AuthApiError: Email not confirmed |
The account exists, but email confirmation is enabled and the user hasn’t clicked the confirmation link. |
| Illegal arguments: undefined, string |
bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required |
bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed. |
| auth/popup-closed-by-user |
Firebase Auth: auth/popup-closed-by-user / auth/popup-blocked / auth/cancelled-popup-request |
The OAuth popup for Google/GitHub sign-in was closed, blocked by the browser, or replaced by another popup re… |
| TokenExpiredError |
JWT Expired / Invalid Token |
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rej… |
| auth/unauthorized-domain |
Firebase Auth: auth/unauthorized-domain — This domain is not authorized for OAuth operations for your Firebase project |
The site’s domain isn’t listed in Firebase Authentication → Settings → Authorized domains. |
| deleted_client |
Google OAuth: Error 401: deleted_client — The OAuth client was deleted |
The OAuth client ID used in the request has been deleted from the Google Cloud project. |
| invalid algorithm |
JWT error: invalid algorithm / The specified alg value is not allowed / jwt signature is required |
The token’s alg header doesn’t match the algorithms the verifier allows — e.g. RS256 token verified as HS256,… |
| NO_SECRET |
NextAuth / Auth.js: [next-auth][error][NO_SECRET] Please define a `secret` in production / MissingSecret |
Auth.js needs a secret (NEXTAUTH_SECRET / AUTH_SECRET) in production to sign and encrypt tokens/cookies. |
| relying party ID is not a registrable domain suffix |
WebAuthn: SecurityError: The relying party ID is not a registrable domain suffix of, nor equal to the current domain |
The rp.id in the WebAuthn options doesn’t match the page’s domain (or a parent domain), so the browser reject… |
| invalid csrf token |
ForbiddenError: invalid csrf token (EBADCSRFTOKEN) |
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie. |
| unauthorized_client |
OAuth 2.0 Error: unauthorized_client (client not allowed to use this grant type) |
The client exists, but isn’t allowed to use the requested flow (grant type or response type). |
| state mismatch |
OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing |
The state value returned to the callback doesn’t match what the app stored before redirecting — the CSRF prot… |
| SameSite cookie blocked |
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure |
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins d… |
| jwt must be provided |
JsonWebTokenError: jwt must be provided |
jwt.verify() was called with an empty value — the token never reached the server code. |
| Clock skew too great |
Kerberos: Clock skew too great (KRB_AP_ERR_SKEW) |
The client’s clock differs from the domain controller’s by more than 5 minutes, so Kerberos tickets are rejec… |
| LDAP error code 49 |
LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e |
Active Directory/LDAP rejected the bind — the data code tells you why (52e wrong password, 525 user not found… |
| jwt not active |
NotBeforeError: jwt not active (nbf claim in the future) |
The token’s nbf (not before) time is in the future for the verifying server — usually clock skew between serv… |
| Invalid login credentials |
Supabase Auth: AuthApiError: Invalid login credentials |
Supabase rejected the email/password — wrong password, no such user, or the user signed up via OAuth/magic li… |
| UserNotConfirmedException |
AWS Cognito: UserNotConfirmedException: User is not confirmed. |
The user signed up but hasn’t confirmed their account (email/SMS code), so Cognito won’t let them sign in. |
| unsupported_grant_type |
OAuth 2.0 Error: unsupported_grant_type |
The token endpoint didn’t recognise grant_type — usually because the body wasn’t sent as application/x-www-fo… |
| unsupported_response_type |
OAuth 2.0 Error: unsupported_response_type |
The authorize request asked for a response_type the client or server doesn’t allow — e.g. token (implicit) wh… |