Wei-Shaw/sub2api · error

auth.verifyFailed

Error message

auth.verifyFailed

What it means

In frontend/src/views/auth/EmailVerifyView.vue:714, after POSTing to /auth/oauth/pending/create-account, the code first handles a pending-OAuth-session response; otherwise it requires isOAuthLoginCompletion(data) (an access_token-carrying response). When the 2xx response is neither shape, it throws the localized 'auth.verifyFailed' — meaning account creation during email verification returned an unexpected payload.

Source

Thrown at frontend/src/views/auth/EmailVerifyView.vue:714

      if (pendingAdoptionDecision.value?.adoptDisplayName !== undefined) {
        payload.adopt_display_name = pendingAdoptionDecision.value.adoptDisplayName
      }
      if (pendingAdoptionDecision.value?.adoptAvatar !== undefined) {
        payload.adopt_avatar = pendingAdoptionDecision.value.adoptAvatar
      }

      const { data } = await apiClient.post<PendingOAuthCreateAccountResponse>(
        '/auth/oauth/pending/create-account',
        payload
      )
      if (isPendingOAuthSessionResponse(data)) {
        sessionStorage.removeItem('register_data')
        persistPendingOAuthSession(data.provider || pendingProvider.value, data.redirect)
        await router.push(resolvePendingOAuthCallbackRoute(data.provider || pendingProvider.value))
        return
      }
      if (!isOAuthLoginCompletion(data)) {
        throw new Error(t('auth.verifyFailed'))
      }

      persistOAuthTokenContext(data)
      await authStore.setToken(data.access_token)
      authStore.clearPendingAuthSession?.()
    } else {
      // Register with verification code
      await authStore.register({
        email: email.value,
        password: password.value,
        verify_code: verifyCode.value.trim(),
        turnstile_token:
          turnstileEnabled.value || aliyunCaptchaEnabled.value
            ? initialTurnstileToken.value || undefined
            : undefined,
        tencent_captcha_ticket: tencentCaptchaEnabled.value ? initialTurnstileToken.value || undefined : undefined,
        tencent_captcha_randstr: tencentCaptchaEnabled.value ? initialTencentCaptchaRandstr.value || undefined : undefined,
        promo_code: promoCode.value || undefined,

View on GitHub (pinned to 073e92d171)

Solutions

1. Log/inspect the raw response body for this POST to identify the actual shape returned (devtools network tab).
2. Ensure frontend and backend are the same deployed version (schema drift is the dominant cause).
3. Clear sessionStorage 'register_data' and retry registration to rule out stale partial state.
4. Have the backend return explicit typed completions (login | pending | error) so the frontend switch is exhaustive.

Example fix

// before
if (!isOAuthLoginCompletion(data)) {
  throw new Error(t('auth.verifyFailed'))
}

// after
if (!isOAuthLoginCompletion(data)) {
  console.warn('create-account unexpected completion', Object.keys(data))
  throw new Error(data?.message || t('auth.verifyFailed'))
}

function isCreateAccountCompletion(d: unknown): d is { access_token: string } {
  return !!d && typeof d === 'object' && typeof (d as any).access_token === 'string' && (d as any).access_token.length > 0;
}

try { await submitCreateAccount(payload); }
catch (e) {
  if (e.message === t('auth.verifyFailed')) {
    showError('Verification session invalid — restart registration');
    await router.replace('/register'); return;
  }
  throw e;
}

When it happens

Trigger: POST /auth/oauth/pending/create-account returns 2xx without access_token and without pending-session fields: server-side error swallowed into an empty success response; API schema drift (token under a renamed field); a duplicate-email edge case returning a plain message object; register_data in sessionStorage stale, so the payload was built from incomplete state.

Common situations: Frontend/backend version mismatch after a partial deploy; user leaving the verify tab open across a backend upgrade; retry after partial failure where the account was already created server-side.

Related errors

• Passkey creation was cancelled
• auth.dingtalk.callbackMissingToken
• auth.linuxdo.callbackMissingToken
• auth.oidc.callbackMissingToken
• auth.oidc.callbackMissingToken

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/9c9644e816b6f5ee. Report an issue: GitHub.