{"record":{"id":"5c0b8d4ca080de41","repo":"ory/kratos","slug":"no-credentials-found","errorCode":null,"errorMessage":"no credentials found","messagePattern":"no credentials found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"selfservice/strategy/idfirst/strategy_login.go","lineNumber":31,"sourceCode":"\t\"github.com/ory/kratos/schema\"\n\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/ory/kratos/identity\"\n\t\"github.com/ory/kratos/selfservice/flow\"\n\t\"github.com/ory/kratos/selfservice/flow/login\"\n\t\"github.com/ory/kratos/session\"\n\t\"github.com/ory/kratos/text\"\n\t\"github.com/ory/kratos/ui/node\"\n\t\"github.com/ory/kratos/x\"\n\t\"github.com/ory/x/decoderx\"\n\t\"github.com/ory/x/sqlcon\"\n)\n\nvar (\n\t_                     login.AAL1FormHydrator = new(Strategy)\n\t_                     login.Strategy         = new(Strategy)\n\tErrNoCredentialsFound                        = errors.New(\"no credentials found\")\n)\n\nfunc (s *Strategy) handleLoginError(r *http.Request, f *login.Flow, payload UpdateLoginFlowWithIdentifierFirstMethod, err error) error {\n\tif f != nil {\n\t\tf.UI.Nodes.SetValueAttribute(\"identifier\", payload.Identifier)\n\t\tif f.Type == flow.TypeBrowser {\n\t\t\tf.UI.SetCSRF(s.d.GenerateCSRFToken(r))\n\t\t}\n\t}\n\n\treturn err\n}\n\nfunc (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (_ *identity.Identity, err error) {\n\tctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), \"selfservice.strategy.idfirst.Strategy.Login\")\n\tdefer otelx.End(span, &err)\n\n\tif !s.d.Config().SelfServiceLoginFlowIdentifierFirstEnabled(ctx) {","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/selfservice/strategy/idfirst/strategy_login.go#L13-L49","documentation":"ErrNoCredentialsFound is the identifier-first login strategy's signal that it cannot hydrate/complete a login because the user has no usable credentials. In the code strategy it is returned when passwordless code login is disabled, or when there is no identity hint and account-enumeration mitigation is disabled.","triggerScenarios":"Login flow where the identity-first strategy finds no registered credential method: (1) code strategy's PopulateLoginMethodIdentifierFirstCredentials runs while SelfServiceCodeStrategy.PasswordlessEnabled is false; (2) no identity hint available and SecurityAccountEnumerationMitigate is false (code/strategy_login.go:712,718).","commonSituations":"Users attempting login with an email that has no verifiable credentials; deployments where passwordless (one-time-code) login was disabled after users were enrolled; hint flows where the identity resolution returned nil.","solutions":["Enable passwordless code login (selfservice.methods.code.passwordless_enabled: true) so users can always sign in via code","Enable account enumeration mitigation (security.account_enumeration_mitigate: true) so the flow returns a generic response instead of leaking existence","Ensure the identifier the user typed actually belongs to an identity with credentials registered (password/passkey/code)","Handle the error in the UI as 'no login method available for this identifier' and route the user to registration/recovery"],"exampleFix":"// before (config.yml)\nselfservice:\n  methods:\n    code:\n      passwordless_enabled: false\n// after\nselfservice:\n  methods:\n    code:\n      passwordless_enabled: true\n  security:\n    account_enumeration_mitigate: true","handlingStrategy":"try-catch","validationCode":"// before initiating login, check the method is enabled\nif !config.SelfServiceCodeStrategy(ctx).PasswordlessEnabled {\n  // don't rely on code login for this identifier\n}","typeGuard":null,"tryCatchPattern":"if errors.Is(err, idfirst.ErrNoCredentialsFound) {\n  // render generic 'no login method for this identifier' UI;\n  // offer registration or recovery links\n}","preventionTips":["Enable passwordless code login if users should always be able to sign in with email only","Enable account enumeration mitigation to avoid leaking which identifiers exist","Ensure users complete registration/verification so credentials exist before login attempts"],"tags":["auth","login","ory","configuration"],"backgroundTag":"authentication-required","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}