What causes "Invalid email __email__" in RocketChat/Rocket.Chat?

Resend the verification email from the user profile after confirming SMTP works (Administration -> Email)

RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-email

error-invalid-email

Error message

Invalid email __email__

What it means

During password login, if the user is not admin, Accounts_EmailVerification is true, and none of login.user.emails has verified === true, validateLoginAttempt throws error-invalid-email. The __email__ placeholder in the message is never interpolated; the actionable meaning is simply that the account has no verified email address.

Source

Thrown at apps/meteor/server/lib/auth/startup.js:453

		});
	}

	if (!!login.user.active !== true) {
		throw new Meteor.Error('error-user-is-not-activated', 'User is not activated', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (!login.user.roles || !Array.isArray(login.user.roles)) {
		throw new Meteor.Error('error-user-has-no-roles', 'User has no roles', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (login.user.roles.includes('admin') === false && login.type === 'password' && settings.get('Accounts_EmailVerification') === true) {
		const validEmail = login.user.emails.filter((email) => email.verified === true);
		if (validEmail.length === 0) {
			throw new Meteor.Error('error-invalid-email', 'Invalid email __email__');
		}
	}

	login = await callbacks.run('onValidateLogin', login);

	await Users.updateLastLoginById(login.user._id);
	setImmediate(() => {
		return callbacks.run('afterValidateLogin', login);
	});

	/**
	 * Trigger the event only when the
	 * user does login in Rocket.chat
	 */
	if (login.type !== 'resume') {
		// App IPostUserLoggedIn event hook
		await Apps.self?.triggerEvent(AppEvents.IPostUserLoggedIn, login.user);
	}

View on GitHub (pinned to b2c16d5842)

Solutions

Resend the verification email from the user profile after confirming SMTP works (Administration -> Email)
As admin, mark the user's email as verified (Administration -> Users -> edit the email -> verified)
Give the user the 'admin' role if appropriate (admins bypass the check)
Disable Accounts_EmailVerification if verified email is not actually required

Defensive patterns

Strategy: validation

Validate before calling

const hasVerifiedEmail = (emails: Array<{ verified?: boolean }> | undefined): boolean =>
  Array.isArray(emails) && emails.some((e) => e?.verified === true);

if (settings.get('Accounts_EmailVerification') === true && !hasVerifiedEmail(user.emails)) {
  // resend verification email or have an admin verify before attempting password login
}

Type guard

const hasVerifiedEmail = (emails: unknown): emails is Array<{ verified: true }> =>
  Array.isArray(emails) && emails.some((e) => (e as { verified?: boolean })?.verified === true);

Try / catch

try {
  await loginWithPassword(user, password);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-invalid-email') {
    // prompt the user to verify their email / resend the verification mail
  }
  throw e;
}

Prevention

Test SMTP delivery before enabling Accounts_EmailVerification
When enabling verification on an existing workspace, verify existing emails in bulk first
Expose 'resend verification email' in the client so users can self-recover

When it happens

Trigger: Meteor.loginWithPassword for a non-admin user with zero verified emails while Accounts_EmailVerification is enabled — the verification link was never clicked, never delivered (broken SMTP), or the setting was enabled after the user already existed.

Common situations: Workspace enables email verification retroactively and locks out existing users; SMTP misconfigured so verification mails never arrive; users registered with typos in their email addresses.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d564f8fe66c2a5b7. Report an issue: GitHub.