XTLS/Xray-core · error

server rejects account: {code}

Error message

server rejects account: {code}

What it means

Thrown in the SOCKS5 client's username/password sub-negotiation (RFC 1929) when the server's reply status byte is non-zero, i.e. the credentials were rejected. The number in the message is the server's status code (commonly 0x01 = general failure).

Source

Thrown at proxy/socks/protocol.go:484

	if authByte == authPassword {
		b.Clear()
		account := request.User.Account.(*Account)
		common.Must(b.WriteByte(0x01))
		common.Must(b.WriteByte(byte(len(account.Username))))
		common.Must2(b.WriteString(account.Username))
		common.Must(b.WriteByte(byte(len(account.Password))))
		common.Must2(b.WriteString(account.Password))
		if err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {
			return nil, err
		}

		b.Clear()
		if _, err := b.ReadFullFrom(reader, 2); err != nil {
			return nil, err
		}
		if b.Byte(1) != 0x00 {
			return nil, errors.New("server rejects account: ", b.Byte(1))
		}
	}

	b.Clear()

	command := byte(cmdTCPConnect)
	if request.Command == protocol.RequestCommandUDP {
		command = byte(cmdUDPAssociate)
	}
	common.Must2(b.Write([]byte{socks5Version, command, 0x00 /* reserved */}))
	if request.Command == protocol.RequestCommandUDP {
		common.Must2(b.Write([]byte{1, 0, 0, 0, 0, 0, 0 /* RFC 1928 */}))
	} else {
		if err := addrParser.WriteAddressPort(b, request.Address, request.Port); err != nil {
			return nil, err
		}
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Re-enter the exact username/password in the outbound servers.users entry, watching for invisible whitespace.
2. Verify the account still exists on the SOCKS5 server side (its users list).
3. Test the same credentials with curl -x socks5://user:pass@host:port to confirm which side is wrong.
4. If the server is Xray too, check its inbound users and any policy level restrictions.

if err := client.Process(ctx, link, dialer); err != nil {
	if strings.Contains(err.Error(), "server rejects account") {
		alertConfigOwner("trojan/socks credentials rejected by server")
	}
	return err
}

When it happens

Trigger: Auth method 0x02 negotiated, Xray sent username/password from the outbound account, and the server validated them and replied with status != 0x00. Happens on every connection attempt until credentials are fixed.

Common situations: Wrong password or username in the outbound config; password changed server-side but not client-side; trailing whitespace/newline pasted into config credentials; server user database reloaded without the account.

Related errors

• invalid username or password
• failed to read auth methods
• no matching auth method
• failed to read username and password for authentication
• unexpected server version: {version}

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6a0a79696adf6e57. Report an issue: GitHub.