What causes "Incorrect email or password" in invoke-ai/InvokeAI?

Verify the email matches an existing user (check the users list via an admin account)

invoke-ai/InvokeAI · error · HTTPException

Incorrect email or password

Error message

Incorrect email or password

What it means

login authenticates via user_service.authenticate(email, password); when no active user matches, it raises 401 with 'Incorrect email or password' and a WWW-Authenticate: Bearer header. The same error covers both wrong email and wrong password (no user enumeration).

Solutions

Verify the email matches an existing user (check the users list via an admin account)
Re-enter the password carefully; use the admin 'reset password' flow if forgotten
Re-run /auth/setup to create the admin if the database was recreated
Clear cached credentials in the client and retry

Defensive patterns

Strategy: try-catch

Validate before calling

# before calling the API, sanity-check inputs client-side
if not email or '@' not in email or not password:
    raise ValueError('Email and password are required')

Type guard

def credentials_valid(creds: dict) -> bool:
    return bool(creds.get('email')) and bool(creds.get('password'))

Try / catch

try:
    resp = requests.post(f'{base}/auth/login', json={'email': email, 'password': password})
    resp.raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 401:
        prompt_reenter_credentials()  # never retry blindly — show login form

Prevention

Prompt the user to re-enter credentials on 401 instead of retrying in a loop
Never cache passwords; re-prompt after DB resets or password changes
Use the admin password-reset flow instead of guessing
Check for keyboard layout/whitespace issues in stored credentials

When it happens

Trigger: POST /auth/login with an email that has no user record, or a password that fails the hash check for that user, while multiuser mode is enabled.

Common situations: Typo'd email; password changed or reset on another client; stale credentials stored in a frontend after the DB was recreated; users table wiped by re-initializing the database.

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/74f5f46e5c4eb1ab. Report an issue: GitHub.

Appendix: source

Thrown at invokeai/app/api/routers/auth.py:224

    Raises:
        HTTPException: 401 if credentials are invalid or user is inactive
        HTTPException: 403 if multiuser mode is disabled
    """
    config = ApiDependencies.invoker.services.configuration

    # Check if multiuser is enabled
    if not config.multiuser:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Multiuser mode is disabled. Authentication is not required in single-user mode.",
        )

    user_service = ApiDependencies.invoker.services.users
    user = user_service.authenticate(login_request.email, login_request.password)

    if user is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    if not user.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User account is disabled")

    # Create token with appropriate expiration
    expires_delta = timedelta(
        days=TOKEN_EXPIRATION_REMEMBER_ME if login_request.remember_me else TOKEN_EXPIRATION_NORMAL
    )
    token_data = TokenData(
        user_id=user.user_id,
        email=user.email,
        is_admin=user.is_admin,
        remember_me=login_request.remember_me,
        token_epoch=user.token_epoch,

View on GitHub (pinned to 0b6a024f2f)