atuinsh/atuin · error

current password is incorrect

Error message

current password is incorrect

What it means

In `HubAuthClient`'s/legacy `change_password`, HTTP 401 from the `PATCH account/password` call is mapped to this bail. 401 means the authentication attached to the request was rejected — here specifically the server declined because the supplied current password does not match the account. The library turns the bare status into this user-facing message.

Solutions

  1. Re-enter the current password carefully and retry the change
  2. Verify the account's current password by logging in fresh (`atuin login`) to rule out an expired session token
  3. Re-authenticate to obtain a new session, then retry `change_password`
  4. If the password was rotated on another device, use that newest password as the current one

Example fix

// before: cannot distinguish bad password from expired session
match resp.status().as_u16() {
    401 => bail!("current password is incorrect"),
// after: verify credentials with a fresh login first
let reauth = auth.login(username, current_password, None).await?;
assert!(matches!(reauth, AuthResponse::Success { .. }));
// then proceed with change_password
Defensive patterns

Strategy: validation

Validate before calling

// Verify the current password by attempting a fresh login before changing it
let check = auth_client.login(username, current_password, totp).await?;
if !matches!(check, AuthResponse::Success { .. }) {
    bail!("current password does not authenticate; aborting change");
}

Type guard

fn is_wrong_current_password(err: &Report) -> bool {
    err.to_string().contains("current password is incorrect")
}

Try / catch

match auth_client.change_password(current, new, totp).await {
    Ok(MutateResponse::Success) => println!("password updated"),
    Err(e) if e.to_string().contains("current password is incorrect") => {
        eprintln!("re-authenticate with the correct current password and retry");
    }
    Err(e) => return Err(e),
}

Prevention

When it happens

Trigger: Calling `change_password(current_password, new_password)` where `current_password` is wrong or stale, or where the session token is expired/invalid so the server cannot authenticate the request at all.

Common situations: Typos or stale credentials in scripts/CI calling `atuin account` password change; the stored login session expired so 401 is about the token, not the password; password was already changed elsewhere (another machine) making the current password out of date.

Related errors

AI-assisted analysis of atuinsh/atuin@900007c480 (2026-09-19). Data as JSON: /api/errors/fcd2ea08bfca7f75. Report an issue: GitHub.

Appendix: source

Thrown at crates/atuin-client/src/auth.rs:205

        new_password: &str,
        _totp_code: Option<&str>,
    ) -> Result<MutateResponse> {
        let client = self.authenticated_client()?;
        let url = self.address.append_path("account/password")?;

        let resp = client
            .patch(url)
            .json(&ChangePasswordRequest {
                current_password: current_password.to_string(),
                new_password: new_password.to_string(),
            })
            .send()
            .await?;

        match resp.status().as_u16() {
            200 => Ok(MutateResponse::Success),
            401 => {
                bail!("current password is incorrect");
            }
            403 => {
                bail!("invalid login details");
            }
            _ => {
                bail!("unknown error");
            }
        }
    }

    async fn delete_account(
        &self,
        password: &str,
        _totp_code: Option<&str>,
    ) -> Result<MutateResponse> {
        let client = self.authenticated_client()?;
        let url = self.address.append(["account"])?;

View on GitHub (pinned to 900007c480)