{"record":{"id":"270b8e6e0bc5925a","repo":"nextcloud/all-in-one","slug":"could-not-log-in-to-desec-invalid-email-address-o","errorCode":null,"errorMessage":"Could not log in to deSEC: invalid email address or password.","messagePattern":"Could not log in to deSEC: invalid email address or password\\.","errorType":"exception","errorClass":"\\Exception","httpStatus":422,"severity":"error","filePath":"php/src/Desec/DesecManager.php","lineNumber":254,"sourceCode":"    /**\n     * Authenticates with an existing deSEC account and returns the API token issued for it.\n     *\n     * @throws \\Exception on invalid credentials, network failure, or an unexpected HTTP response\n     */\n    public function loginAccount(string $email, string $password): string {\n        try {\n            $res = $this->guzzleClient->post($this->configurationManager->desecApiBase . '/auth/login/', [\n                'json' => ['email' => $email, 'password' => $password],\n            ]);\n        } catch (TransferException $e) {\n            throw new \\Exception('Could not reach the deSEC API: ' . $e->getMessage());\n        }\n\n        $code = $res->getStatusCode();\n        $body = $res->getBody()->getContents();\n\n        if ($code === 400 || $code === 403) {\n            throw new \\Exception('Could not log in to deSEC: invalid email address or password.');\n        }\n\n        if ($code !== 200 && $code !== 201) {\n            throw new \\Exception('Unexpected response from deSEC during login (HTTP ' . $code . '): ' . $body);\n        }\n\n        $data = json_decode($body, true, 512, JSON_THROW_ON_ERROR);\n        if (!is_array($data) || !isset($data['token']) || !is_string($data['token'])) {\n            throw new \\Exception('Could not extract the API token from the deSEC login response. Please try again.');\n        }\n\n        return $data['token'];\n    }\n\n    /**\n     * Registers a dedyn.io domain for the authenticated account.\n     * When $slug is empty a random 10-character slug is tried up to MAX_SLUG_ATTEMPTS times.\n     *","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Desec/DesecManager.php#L236-L272","documentation":"deSEC answered POST /auth/login/ with 400 or 403, which the manager maps to invalid email address or password. 400 typically means a malformed login request (bad email syntax, missing field); 403 means the credentials were checked and rejected.","triggerScenarios":"Wrong password for the existing account; email with a typo; empty password; the account's password was changed or reset at desec.io after AIO generated one; 403 can also follow repeated failed attempts.","commonSituations":"User reuses an old password after changing it on desec.io; user believes a new account was created but the email already existed (so the generated password never applied); paste artifacts like trailing whitespace in the password field.","solutions":["Re-enter the deSEC password carefully, checking for typos and stray whitespace","Confirm the email address is exactly the one the deSEC account is registered under","If forgotten, reset the password at desec.io first, then retry","Make sure the account's verification email was clicked — unverified accounts cannot log in"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Normalize inputs before login\n$email = trim($email);\n$password = rtrim($password, \" \\t\\n\\r\");\nif ($email === '' || $password === '') {\n    throw new \\InvalidArgumentException('Email and password are both required.');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $token = $manager->loginAccount($email, $password);\n} catch (\\Exception $e) {\n    if ($e->getMessage() === 'Could not log in to deSEC: invalid email address or password.') {\n        showFieldError('password', 'Wrong deSEC credentials — re-enter or reset at desec.io');\n        return;\n    }\n    throw $e;\n}","preventionTips":["Trim whitespace from pasted credentials on both client and server side","Do not auto-retry invalid credentials — repeated failures can escalate into rate limiting","Offer a direct 'reset password at desec.io' link next to the password field"],"tags":["php","desec","authentication","credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}