{"record":{"id":"48ae1fb7662e5b69","repo":"ory/kratos","slug":"required-credentials-not-found","errorCode":null,"errorMessage":"required credentials not found","messagePattern":"required credentials not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"x/webauthnx/errors.go","lineNumber":12,"sourceCode":"// Copyright © 2023 Ory Corp\n// SPDX-License-Identifier: Apache-2.0\n\npackage webauthnx\n\nimport (\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/ory/jsonschema/v3\"\n)\n\nvar ErrNoCredentials = errors.New(\"required credentials not found\")\n\nfunc ErrNotEnoughCredentials() *jsonschema.ValidationError {\n\treturn &jsonschema.ValidationError{Message: \"unable to remove this security key because it would lock you out of your account\", InstancePtr: \"#/webauthn_remove\"}\n}\n\n// ErrCredentialAlreadyRegistered is returned when a settings flow submits a credential whose ID\n// is already registered on the identity. Compliant browsers prevent this via excludeCredentials,\n// so this guards against clients that ignore the exclusion list.\nfunc ErrCredentialAlreadyRegistered(instancePtr string) *jsonschema.ValidationError {\n\treturn &jsonschema.ValidationError{Message: \"this security key or passkey is already registered with your account\", InstancePtr: instancePtr}\n}\n","sourceCodeStart":1,"sourceCodeEnd":24,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/x/webauthnx/errors.go#L1-L24","documentation":"ErrNoCredentials is the sentinel error from x/webauthnx (identifier-first flows) signaling that no usable credentials/hints were found to populate the identifier-first login step. Strategies like the code strategy re-wrap idfirst.ErrNoCredentialsFound when passwordless is disabled or account-enumeration mitigation withholds identity hints. It lets callers distinguish 'no credentials known' from real failures.","triggerScenarios":"Passwordless code login attempted while selfservice.methods.code.passwordless_enabled is false; an identifier-first login submits an unknown identifier while security.account_enumeration_mitigation.enabled is true (hint withheld).","commonSituations":"End user tries one-tap code login before any identity exists; admin disabled passwordless after users saved the flow as a bookmark; enumeration mitigation intentionally returning this error for unknown identifiers.","solutions":["Enable code passwordless: set selfservice.methods.code.passwordless_enabled: true in config if one-tap login is intended","If mitigation is enabled, expect this error for unknown identifiers and show a generic 'check your email' message instead of a hard failure","Verify the identifier exists via the identifier-first flow before attempting code login","Use errors.Is(err, idfirst.ErrNoCredentialsFound) to detect this case and branch UI accordingly"],"exampleFix":"// before\nerr := s.d.RegistrationExecutor().PostRegistrationHook(...)\n// treat any error as fatal\n// after\nif errors.Is(err, idfirst.ErrNoCredentialsFound) {\n    // show neutral \"check your inbox\" message\n    return nil\n}","handlingStrategy":"try-catch","validationCode":"// client-side: only attempt passwordless login if the identifier is known-registered and passwordless is enabled","typeGuard":null,"tryCatchPattern":"if errors.Is(err, idfirst.ErrNoCredentialsFound) { showNeutralMessage(); return nil } // do not leak whether identifier exists","preventionTips":["Enable passwordless only where intended and inform users","Handle this sentinel explicitly in login UIs","Keep account-enumeration UX generic","Check config before advertising passwordless options"],"tags":["go","webauthn","identifier-first","error-handling"],"backgroundTag":"authentication-required","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}