SigNoz/signoz · error · errors.SignozError

ErrCodeIncorrectPassword

ErrCodeIncorrectPassword

Error message

invalid email or password

What it means

Returned by email/password authentication when the stored password factor does not match the supplied password. The message deliberately says "invalid email or password" to avoid revealing which credential is wrong.

Source

Thrown at pkg/authn/passwordauthn/emailpasswordauthn/authn.go:30

var _ authn.PasswordAuthN = (*AuthN)(nil)

type AuthN struct {
	store authtypes.AuthNStore
}

func New(store authtypes.AuthNStore) *AuthN {
	return &AuthN{store: store}
}

func (a *AuthN) Authenticate(ctx context.Context, email string, password string, orgID valuer.UUID) (*authtypes.Identity, error) {
	user, factorPassword, _, err := a.store.GetActiveUserAndFactorPasswordByEmailAndOrgID(ctx, email, orgID)
	if err != nil {
		return nil, err
	}

	if !factorPassword.Equals(password) {
		return nil, errors.New(errors.TypeUnauthenticated, types.ErrCodeIncorrectPassword, "invalid email or password")
	}

	return authtypes.NewPrincipalUserIdentity(user.ID, orgID, user.Email, authtypes.IdentNProviderTokenizer), nil
}

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Verify the user is typing the current password for the correct org (orgID matches the login page)
2. Check the client sends the raw password exactly (no double-hashing, no whitespace trimming) and correct email casing
3. If system-wide, verify password factor records/hashing config (e.g. bcrypt cost, migration) are consistent

id, err := authn.Authenticate(ctx, email, orgID, password)
if err != nil {
    if errors.Is(err, types.ErrCodeIncorrectPassword) || strings.Contains(err.Error(), "invalid email or password") {
        // return 401 to user, do not leak which field was wrong
        render.Error(rw, err)
        return
    }
    return err // store failure etc.
}

When it happens

Trigger: Calling Authenticate (via CreatePasswordAuthNSession) with a password that fails factorPassword.Equals(password), i.e. wrong password (or wrong-hash-stored factor) for an active user found by email+orgID.

Common situations: User typos or stale credentials after a password reset; frontend sending trimmed/hashed password instead of the raw one; orgID mismatch so the right user record isn't found; password factor migrated with a different hashing scheme.

Related errors

• CodeInvalidInput
• api_key_expired
• errors.CodeUnauthenticated
• errors.CodeUnauthenticated
• CodeTooManyRequests

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/76bdffe7c7460d0a. Report an issue: GitHub.