{"record":{"id":"92eaeb48c63dc66f","repo":"mastra-ai/mastra","slug":"invalid-email-or-password-92eaeb","errorCode":null,"errorMessage":"Invalid email or password","messagePattern":"Invalid email or password","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"packages/server/src/server/handlers/auth.ts","lineNumber":708,"sourceCode":"      });\n\n      // Build response headers, including cookies from the auth provider\n      const headers = new Headers({\n        'Content-Type': 'application/json',\n      });\n\n      // Forward session cookies from the auth provider\n      if (result.cookies?.length) {\n        for (const cookie of result.cookies) {\n          headers.append('Set-Cookie', cookie);\n        }\n      }\n\n      return new Response(responseBody, { status: 200, headers });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      // Return a generic error for auth failures to avoid leaking info\n      throw new HTTPException(401, { message: 'Invalid email or password' });\n    }\n  },\n});\n\n// ============================================================================\n// POST /auth/credentials/sign-up\n// ============================================================================\n\nexport const POST_CREDENTIALS_SIGN_UP_ROUTE = createPublicRoute({\n  method: 'POST',\n  path: '/auth/credentials/sign-up',\n  responseType: 'datastream-response',\n  bodySchema: credentialsSignUpBodySchema,\n  summary: 'Sign up with credentials',\n  description: 'Creates a new user account with email and password.',\n  tags: ['Auth'],\n  handler: async ctx => {\n    const { mastra, request, email, password, name } = ctx as any;","sourceCodeStart":690,"sourceCodeEnd":726,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/auth.ts#L690-L726","documentation":"This 401 is thrown by the POST /auth/credentials/sign-in handler in packages/server when the credentials provider's signIn call fails for any reason. The handler deliberately returns a generic message ('Invalid email or password') instead of the underlying error, to avoid leaking whether an account exists. Any non-HTTPException failure inside the sign-in flow — not just wrong passwords — is collapsed into this response.","triggerScenarios":"POST /auth/credentials/sign-in with an email that has no registered user; a wrong password for an existing user; a credentials provider that is not configured and fails internally; any unexpected exception thrown by the provider's signIn() (DB down, provider bug), since the catch block converts everything non-HTTPException into this 401.","commonSituations":"Typos or stale credentials in client login forms; user never completed sign-up; passwords reset out-of-band; database unavailable so the user lookup fails and is masked as a credential error; developer misreads the generic message and can't tell auth failure from provider misconfiguration.","solutions":["Verify the email/password pair is correct (user exists and password matches) via the sign-up flow or a password reset.","Check server logs — the handler may not log the underlying error, so reproduce locally and inspect the credentials provider's signIn implementation for non-auth exceptions.","Confirm the credentials auth provider is properly configured on the Mastra instance (server-ops), since a broken provider surfaces as this same 401.","If you own the handler and need distinguishable errors, log error.message server-side before rethrowing the generic 401 — do not change the response message."],"exampleFix":"// before (client)\nconst res = await fetch('/auth/credentials/sign-in', { method: 'POST', body: JSON.stringify({ email, password }) });\nif (!res.ok) throw new Error(await res.text());\n\n// after (client: surface a friendly message on 401)\nif (res.status === 401) throw new Error('Invalid email or password. Please check your credentials or reset your password.');","handlingStrategy":"try-catch","validationCode":"if (!email || !email.includes('@') || !password) {\n  throw new Error('Email and password are required before calling sign-in');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('/auth/credentials/sign-in', { method: 'POST', body: JSON.stringify({ email, password }) });\n  if (res.status === 401) throw new SignInError('Invalid email or password');\n  if (!res.ok) throw new SignInError(`Sign-in failed: ${res.status}`);\n} catch (e) {\n  // Never retry blindly; surface a generic message and offer password reset\n  showLoginError(e instanceof SignInError ? e.message : 'Unable to sign in');\n}","preventionTips":["Validate email format and non-empty password client-side before submitting.","Provide a password-reset flow so users aren't locked out.","Check server-side provider/DB health if 401s spike — non-auth failures are masked as this 401.","Never leak whether the email exists; keep the generic message in UX too."],"tags":["auth","http-401","credentials"],"backgroundTag":"invalid-login-credentials","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}