AlistGo/alist · error

signin failed: %s

Error message

signin failed: %s

What it means

Final step of SMS login: POST verification_code + verification_token + username to /v1/auth/signin. Thrown when the response is an HTTP error, has an error field, or the returned AccessToken is empty. On success the driver stores tokens and clears the one-time VerifyCode; on failure nothing is persisted.

Source

Thrown at drivers/guangyapan/driver.go:648

		return fmt.Errorf("verify code failed: %s", d.accountErr(step2.ErrorDesc, step2.Error, resp))
	}

	var out tokenResp
	resp, err = d.accountClient.R().
		SetContext(ctx).
		SetBody(map[string]any{
			"verification_code":  d.VerifyCode,
			"verification_token": step2.VerificationToken,
			"username":           normalizePhoneE164(d.PhoneNumber),
			"client_id":          d.ClientID,
		}).
		SetResult(&out).
		Post("/v1/auth/signin")
	if err != nil {
		return err
	}
	if resp.IsError() || out.Error != "" || strings.TrimSpace(out.AccessToken) == "" {
		return fmt.Errorf("signin failed: %s", d.accountErr(out.ErrorDesc, out.Error, resp))
	}

	d.AccessToken = strings.TrimSpace(out.AccessToken)
	d.RefreshToken = strings.TrimSpace(out.RefreshToken)
	d.VerificationID = ""
	// One-time SMS code should not be reused after successful login.
	d.VerifyCode = ""
	op.MustSaveDriverStorage(d)
	return nil
}

func (d *GuangYaPan) prepareSMSCode(ctx context.Context) error {
	// Explicit send action should always refresh verification_id.
	d.VerificationID = ""
	if err := d.ensureCaptchaToken(ctx, false); err != nil {
		return err
	}
	verificationID, err := d.requestVerificationID(ctx)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Restart the full SMS login flow quickly: new code, immediate save.
2. Verify phone_number is in a format normalizePhoneE164 keeps intact (correct country code).
3. Check the embedded errMsg for hints (invalid token vs server error) and retry later for 5xx.

if err := d.loginBySMSCode(ctx); err != nil {
    if strings.Contains(err.Error(), "signin failed") {
        // verification_token likely expired mid-flow; restart from code request
        return d.loginBySMSCode(ctx) // only after fetching a fresh code
    }
    return err
}

When it happens

Trigger: signin called after a successful verify step but the provider rejects the signin (expired verification_token, username/phone mismatch after normalizePhoneE164, wrong client_id, or server-side error).

Common situations: Delay between verify and signin long enough that the verification_token expires; phone number normalized to E164 does not match the account; ClientID changed from the default; transient provider outage during login.

Related errors

• verify code failed: %s
• request verification failed: %s
• validate token failed: status=%d body=%s
• refresh token failed: %s
• init captcha token failed: %s

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/9a91cfe794713878. Report an issue: GitHub.