{"record":{"id":"3b5c312e952b9e41","repo":"langfuse/langfuse","slug":"invalid-credentials-3b5c31","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"web/src/server/auth.ts","lineNumber":125,"sourceCode":"      }\n\n      // EE: Check custom SSO enforcement\n      const multiTenantSsoProvider =\n        await getSsoAuthProviderIdForDomain(domain);\n      if (multiTenantSsoProvider) {\n        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);\n      }\n\n      const dbUser = await prisma.user.findUnique({\n        where: {\n          email: credentials.email.toLowerCase(),\n        },\n      });\n\n      if (!dbUser) {\n        // Keep bcrypt work comparable across failed login paths to reduce timing-based user enumeration.\n        await hashPassword(credentials.password);\n        throw new Error(\"Invalid credentials\");\n      }\n\n      if (dbUser.password === null) {\n        throw new Error(\n          \"Please sign in with the identity provider (e.g. Google, GitHub, Azure AD, etc.) that is linked to your account.\",\n        );\n      }\n\n      const isValidPassword = await verifyPassword(\n        credentials.password,\n        dbUser.password,\n      );\n      if (!isValidPassword) throw new Error(\"Invalid credentials\");\n\n      const userObj = {\n        id: dbUser.id,\n        name: dbUser.name,\n        email: dbUser.email,","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/server/auth.ts#L107-L143","documentation":"authorize() throws generic 'Invalid credentials' when no user exists for the email; it deliberately hashes the supplied password first so failed-user and failed-password paths take comparable time, mitigating user enumeration.","triggerScenarios":"Email/password sign-in where the email has no user record in Postgres.","commonSituations":"Typos in email; signing in to the wrong instance/environment where the account doesn't exist; sign-up never completed so the user row is absent.","solutions":["Confirm the email is registered on this instance (check with an admin or the sign-up flow)","Fix typos / verify you're on the right host","If the account should exist, check the users table for the exact lowercase email"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client side: validate email format before submitting the credentials form\nif (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) return showError('Enter a valid email');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim/lowercase emails before submit","Surface a generic error to users; log details server-side only"],"tags":["nextauth","authentication","invalid-credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}