invoke-ai/InvokeAI · error · HTTPException

Incorrect email or password

Error message

Incorrect email or password

What it means

login authenticates via user_service.authenticate(email, password); when no active user matches, it raises 401 with 'Incorrect email or password' and a WWW-Authenticate: Bearer header. The same error covers both wrong email and wrong password (no user enumeration).

Source

Thrown at invokeai/app/api/routers/auth.py:224

    Raises:
        HTTPException: 401 if credentials are invalid or user is inactive
        HTTPException: 403 if multiuser mode is disabled
    """
    config = ApiDependencies.invoker.services.configuration

    # Check if multiuser is enabled
    if not config.multiuser:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Multiuser mode is disabled. Authentication is not required in single-user mode.",
        )

    user_service = ApiDependencies.invoker.services.users
    user = user_service.authenticate(login_request.email, login_request.password)

    if user is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    if not user.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User account is disabled")

    # Create token with appropriate expiration
    expires_delta = timedelta(
        days=TOKEN_EXPIRATION_REMEMBER_ME if login_request.remember_me else TOKEN_EXPIRATION_NORMAL
    )
    token_data = TokenData(
        user_id=user.user_id,
        email=user.email,
        is_admin=user.is_admin,
        remember_me=login_request.remember_me,
        token_epoch=user.token_epoch,

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Verify the email matches an existing user (check the users list via an admin account)
2. Re-enter the password carefully; use the admin 'reset password' flow if forgotten
3. Re-run /auth/setup to create the admin if the database was recreated
4. Clear cached credentials in the client and retry

# before calling the API, sanity-check inputs client-side
if not email or '@' not in email or not password:
    raise ValueError('Email and password are required')

def credentials_valid(creds: dict) -> bool:
    return bool(creds.get('email')) and bool(creds.get('password'))

try:
    resp = requests.post(f'{base}/auth/login', json={'email': email, 'password': password})
    resp.raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 401:
        prompt_reenter_credentials()  # never retry blindly — show login form

When it happens

Trigger: POST /auth/login with an email that has no user record, or a password that fails the hash check for that user, while multiuser mode is enabled.

Common situations: Typo'd email; password changed or reset on another client; stale credentials stored in a frontend after the DB was recreated; users table wiped by re-initializing the database.

Related errors

• Authentication required
• Multiuser mode is disabled. Authentication is not required i
• User account is disabled
• Invalid or expired token
• User not found

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/74f5f46e5c4eb1ab. Report an issue: GitHub.