{"record":{"id":"79861bd4a826e651","repo":"mastra-ai/mastra","slug":"invalid-email-or-password-79861b","errorCode":null,"errorMessage":"Invalid email or password","messagePattern":"Invalid email or password","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/neon/src/index.ts","lineNumber":297,"sourceCode":"\n    return true;\n  }\n\n  // ── ICredentialsProvider ──\n\n  async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n    const response = await fetch(`${this.baseUrl}/auth/sign-in/email`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...(request?.headers ? Object.fromEntries(request.headers.entries()) : {}),\n      },\n      body: JSON.stringify({ email, password }),\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Invalid email or password');\n    }\n\n    const result = (await response.json()) as { user?: NeonSessionResponse['user']; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Invalid email or password');\n    }\n\n    const cookies = parseCookies(response);\n\n    return {\n      user: mapNeonUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  async signUp(","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/neon/src/index.ts#L279-L315","documentation":"Thrown in signIn() when the Neon Auth sign-in API responds with a non-OK status. The library first tries to surface the server-provided message from the error body; if the body has no message (or the body isn't JSON), it falls back to this generic message. It deliberately hides the real cause to avoid leaking whether the account exists.","triggerScenarios":"Calling auth.signIn({ email, password }) where the credentials are wrong, the user doesn't exist, the response body is not JSON, or the server returns an error without a 'message' field.","commonSituations":"Typos in email/password; user never signed up with Neon Auth; a reverse proxy returning an HTML 502 page (body parse fails, so the real cause is masked); Neon Auth API changed its error body shape.","solutions":["Double-check the email and password being passed","Register the user first (sign-up) before calling signIn","Log the underlying HTTP response (or add temporary logging) to see the server's actual status/body — a 502/503 indicates infrastructure, not bad credentials","If a custom error message is expected, ensure the Neon Auth error responses include a 'message' field"],"exampleFix":"// before\nawait auth.signIn({ email: userInput.email, password: userInput.password });\n// after\nif (!userExists(email)) await auth.signUp({ email, password });\nawait auth.signIn({ email, password });","handlingStrategy":"try-catch","validationCode":"function assertSignInInput(email: unknown, password: unknown): asserts email is string {\n  if (typeof email !== 'string' || !email.includes('@') || email.length === 0) {\n    throw new Error('A valid email is required');\n  }\n  if (typeof password !== 'string' || password.length === 0) {\n    throw new Error('A password is required');\n  }\n}","typeGuard":"function isAuthError(err: unknown): err is Error & { message: string } {\n  return err instanceof Error && /invalid email or password/i.test(err.message);\n}","tryCatchPattern":"try {\n  const session = await auth.signIn({ email, password });\n} catch (err) {\n  if (isAuthError(err)) {\n    showUserFriendlyError('Those credentials do not match an account'); // don't leak which field failed\n  } else {\n    throw err; // infrastructure error — surface it\n  }\n}","preventionTips":["Show a generic message to end users; log server-side details separately","Ensure users complete sign-up before attempting sign-in","If errors persist despite correct credentials, check whether the response is actually an HTML error page (proxy/network issue)","Add rate limiting to prevent credential stuffing against signIn"],"tags":["auth","neon","login","credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}