{"record":{"id":"85d0fc8a5bf2fab9","repo":"git-ecosystem/git-credential-manager","slug":"errorsecauthfailed","errorCode":"ErrorSecAuthFailed","errorMessage":"Authorization/Authentication failed.","messagePattern":"Authorization/Authentication failed\\.","errorType":"error_code","errorClass":"InteropException","httpStatus":null,"severity":"error","filePath":"src/Core/Interop/MacOS/Native/SecurityFramework.cs","lineNumber":146,"sourceCode":"        public const int ErrorSecAuthFailed = -25293;\n        public const int ErrorSecDuplicateItem = -25299;\n        public const int ErrorSecItemNotFound = -25300;\n        public const int ErrorSecInteractionNotAllowed = -25308;\n        public const int ErrorSecInteractionRequired = -25315;\n        public const int ErrorSecNoSuchAttr = -25303;\n\n        public static void ThrowIfError(int error, string defaultErrorMessage = \"Unknown error.\")\n        {\n            switch (error)\n            {\n                case OK:\n                    return;\n                case ErrorSecNoSuchKeychain:\n                    throw new InteropException(\"The keychain does not exist.\", error);\n                case ErrorSecInvalidKeychain:\n                    throw new InteropException(\"The keychain is not valid.\", error);\n                case ErrorSecAuthFailed:\n                    throw new InteropException(\"Authorization/Authentication failed.\", error);\n                case ErrorSecDuplicateItem:\n                    throw new InteropException(\"The item already exists.\", error);\n                case ErrorSecItemNotFound:\n                    throw new InteropException(\"The item cannot be found.\", error);\n                case ErrorSecInteractionNotAllowed:\n                    throw new InteropException(\"Interaction with the Security Server is not allowed.\", error);\n                case ErrorSecInteractionRequired:\n                    throw new InteropException(\"User interaction is required.\", error);\n                case ErrorSecNoSuchAttr:\n                    throw new InteropException(\"The attribute does not exist.\", error);\n                default:\n                    throw new InteropException(defaultErrorMessage, error);\n            }\n        }\n    }\n\n    [Flags]\n    public enum SessionAttributeBits","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Interop/MacOS/Native/SecurityFramework.cs#L128-L164","documentation":"InteropException thrown by SecurityFramework.ThrowIfError when the macOS Security framework returns errSecAuthFailed (-25293). It means the keychain rejected an authorization/authentication attempt, e.g. the user entered a wrong password, denied access, or the caller lacks rights to unlock or read the keychain item. The library surfaces raw Security.framework result codes as exceptions when wrapping P/Invoke calls.","triggerScenarios":"Calling keychain P/Invokes such as SecKeychainFindGenericPassword, SecKeychainItemCopyContent, SecItemCopyMatching, or SecKeychainAddGenericPassword (via ThrowIfError) when the keychain is locked and the supplied/unlock password is wrong, the user clicked Deny in the access prompt, or the ACL does not grant the calling app access to the item.","commonSituations":"Running in an SSH/headless session where no GUI user can answer the keychain unlock prompt; a keychain locked with a password different from the login password; the app was re-signed or rebuilt so its code signature no longer matches the item ACL; CI machines with a locked login keychain; wrong credentials passed programmatically to SecKeychainUnlock or item creation.","solutions":["Unlock the keychain first (open Keychain Access and unlock it, or call SecKeychainUnlock with the correct password).","Reset the item's ACL: delete the existing keychain item and re-create it from this app so the access control list trusts the current binary.","Run inside a logged-in GUI session instead of SSH/launchd headless context, or provision the keychain for CI (security unlock-keychain with correct password).","Verify the app's code signature matches the one that originally stored the item; re-store the password after re-signing.","Check the password/credentials being passed are correct; repeated failures on unlock also surface as errSecAuthFailed."],"exampleFix":"// before: assuming the login keychain is always unlocked\nint err = SecKeychainFindGenericPassword(null, serviceLength, service, accountLength, account, out length, out data, IntPtr.Zero);\nSecurityFramework.ThrowIfError(err); // throws InteropException -25293 when keychain is locked\n\n// after: unlock the keychain explicitly before querying\nbyte[] password = Encoding.UTF8.GetBytes(userPassword);\nerr = SecKeychainUnlock(keychainRef, (uint)password.Length, password, false);\nSecurityFramework.ThrowIfError(err);\nerr = SecKeychainFindGenericPassword(null, serviceLength, service, accountLength, account, out length, out data, IntPtr.Zero);\nSecurityFramework.ThrowIfError(err);","handlingStrategy":"try-catch","validationCode":"// Check keychain lock state before calling (macOS CLI or via SecKeychainGetStatus)\n// security show-keychain-info login.keychain  # fails or prompts if locked\nvar status = SecKeychainGetStatus(keychainRef, out SecKeychainStatus flags);\nbool keychainUnlocked = (flags & SecKeychainStatus.Unlocked) != 0;\nif (!keychainUnlocked) UnlockKeychainWithStoredPassword();","typeGuard":"static bool IsSecAuthFailed(InteropException ex) => ex.ErrorCode == -25293; // errSecAuthFailed","tryCatchPattern":"try\n{\n    ReadCredentialFromKeychain(service, account);\n}\ncatch (InteropException ex) when (ex.ErrorCode == -25293)\n{\n    // Wrong password / access denied / keychain locked.\n    // Re-prompt the user, re-store the credential, or unlock the keychain.\n    logger.LogWarning(\"Keychain auth failed for {Service}\", service);\n    await ReauthenticateAndReStoreAsync();\n}","preventionTips":["Unlock the keychain (SecKeychainUnlock or `security unlock-keychain`) before automated keychain access.","Run keychain-touching code in a logged-in GUI session; avoid SSH/daemons for interactive items.","Re-store credentials after re-signing or rebuilding the app so its ACL matches the binary signature.","Never pass guessed passwords to unlock calls; fetch them from a trusted bootstrap source.","Catch InteropException by its ErrorCode rather than message text when differentiating keychain failures."],"tags":["macos","keychain","security-framework","authentication","interop"],"backgroundTag":"authentication-required","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}