{"record":{"id":"10f76636ead0409a","repo":"atuinsh/atuin","slug":"password-is-incorrect","errorCode":null,"errorMessage":"password is incorrect","messagePattern":"password is incorrect","errorType":"http","errorClass":null,"httpStatus":401,"severity":"critical","filePath":"crates/atuin-client/src/auth.rs","lineNumber":230,"sourceCode":"            }\n        }\n    }\n\n    async fn delete_account(\n        &self,\n        password: &str,\n        _totp_code: Option<&str>,\n    ) -> Result<MutateResponse> {\n        let client = self.authenticated_client()?;\n        let url = self.address.append([\"account\"])?;\n\n        let resp =\n            client.delete(url).json(&serde_json::json!({ \"password\": password })).send().await?;\n\n        match resp.status().as_u16() {\n            200 => Ok(MutateResponse::Success),\n            401 => {\n                bail!(\"password is incorrect\");\n            }\n            403 => {\n                bail!(\"invalid login details\");\n            }\n            _ => {\n                bail!(\"unknown error\");\n            }\n        }\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Hub backend — talks to the Hub v0 API endpoints\n// ---------------------------------------------------------------------------\n\npub struct HubAuthClient {\n    address: Url,\n    hub_token: Option<String>,","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/atuinsh/atuin/blob/900007c48045867e7f44b0f9bc55ad9dbe99ee0d/crates/atuin-client/src/auth.rs#L212-L248","documentation":"In `delete_account`, HTTP 401 from the `DELETE account` request is mapped to this bail. The server rejected the request's authentication; per the API contract the client reports it as the supplied account password being incorrect. It means the password confirmations (and/or session) did not validate server-side.","triggerScenarios":"Calling `delete_account(password)` where `password` does not match the account's current password, or where the session token is expired/invalid.","commonSituations":"Deleting an account from an old machine whose stored session expired; typing a password that was changed on another device; scripted deletion using stale credentials from env/config.","solutions":["Re-enter the account password carefully and retry","Refresh the session with `atuin login` in case 401 reflects an expired token rather than a wrong password","If the password was rotated elsewhere, use the latest password","Confirm you are targeting the correct sync server/account before deleting"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// Confirm the password is valid before a destructive delete\nlet check = auth_client.login(username, password, totp).await?;\nif !matches!(check, AuthResponse::Success { .. }) {\n    bail!(\"password does not authenticate; refusing to attempt account deletion\");\n}","typeGuard":"fn is_wrong_delete_password(err: &Report) -> bool {\n    err.to_string() == \"password is incorrect\"\n}","tryCatchPattern":"match auth_client.delete_account(password, totp).await {\n    Ok(MutateResponse::Success) => println!(\"account deleted\"),\n    Err(e) if e.to_string() == \"password is incorrect\" => {\n        eprintln!(\"re-authenticate with the correct password; account NOT deleted\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Always verify credentials with a login attempt before destructive account actions","Refresh expired sessions with `atuin login` before deleting","Use interactive password prompts, not cached/stale credentials","Confirm which account you are deleting to avoid irreversible mistakes"],"tags":["http","authentication","atuin","account-deletion"],"backgroundTag":"authentication-required","analyzedSha":"900007c48045867e7f44b0f9bc55ad9dbe99ee0d","analyzedAt":"2026-09-19T12:52:51.491Z","contentChangedAt":"2026-09-19T12:52:51.491Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}