atuinsh/atuin · critical

password is incorrect

Error message

password is incorrect

What it means

In `delete_account`, HTTP 401 from the `DELETE account` request is mapped to this bail. The server rejected the request's authentication; per the API contract the client reports it as the supplied account password being incorrect. It means the password confirmations (and/or session) did not validate server-side.

Solutions

  1. Re-enter the account password carefully and retry
  2. Refresh the session with `atuin login` in case 401 reflects an expired token rather than a wrong password
  3. If the password was rotated elsewhere, use the latest password
  4. Confirm you are targeting the correct sync server/account before deleting

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

// Confirm the password is valid before a destructive delete
let check = auth_client.login(username, password, totp).await?;
if !matches!(check, AuthResponse::Success { .. }) {
    bail!("password does not authenticate; refusing to attempt account deletion");
}

Type guard

fn is_wrong_delete_password(err: &Report) -> bool {
    err.to_string() == "password is incorrect"
}

Try / catch

match auth_client.delete_account(password, totp).await {
    Ok(MutateResponse::Success) => println!("account deleted"),
    Err(e) if e.to_string() == "password is incorrect" => {
        eprintln!("re-authenticate with the correct password; account NOT deleted");
    }
    Err(e) => return Err(e),
}

Prevention

When it happens

Trigger: Calling `delete_account(password)` where `password` does not match the account's current password, or where the session token is expired/invalid.

Common situations: Deleting an account from an old machine whose stored session expired; typing a password that was changed on another device; scripted deletion using stale credentials from env/config.

Related errors

AI-assisted analysis of atuinsh/atuin@900007c480 (2026-09-19). Data as JSON: /api/errors/10f76636ead0409a. Report an issue: GitHub.

Appendix: source

Thrown at crates/atuin-client/src/auth.rs:230

            }
        }
    }

    async fn delete_account(
        &self,
        password: &str,
        _totp_code: Option<&str>,
    ) -> Result<MutateResponse> {
        let client = self.authenticated_client()?;
        let url = self.address.append(["account"])?;

        let resp =
            client.delete(url).json(&serde_json::json!({ "password": password })).send().await?;

        match resp.status().as_u16() {
            200 => Ok(MutateResponse::Success),
            401 => {
                bail!("password is incorrect");
            }
            403 => {
                bail!("invalid login details");
            }
            _ => {
                bail!("unknown error");
            }
        }
    }
}

// ---------------------------------------------------------------------------
// Hub backend — talks to the Hub v0 API endpoints
// ---------------------------------------------------------------------------

pub struct HubAuthClient {
    address: Url,
    hub_token: Option<String>,

View on GitHub (pinned to 900007c480)