langfuse/langfuse · warning · Error

Invalid credentials

Error message

Invalid credentials

What it means

authorize() throws generic 'Invalid credentials' when no user exists for the email; it deliberately hashes the supplied password first so failed-user and failed-password paths take comparable time, mitigating user enumeration.

Source

Thrown at web/src/server/auth.ts:125

      }

      // EE: Check custom SSO enforcement
      const multiTenantSsoProvider =
        await getSsoAuthProviderIdForDomain(domain);
      if (multiTenantSsoProvider) {
        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);
      }

      const dbUser = await prisma.user.findUnique({
        where: {
          email: credentials.email.toLowerCase(),
        },
      });

      if (!dbUser) {
        // Keep bcrypt work comparable across failed login paths to reduce timing-based user enumeration.
        await hashPassword(credentials.password);
        throw new Error("Invalid credentials");
      }

      if (dbUser.password === null) {
        throw new Error(
          "Please sign in with the identity provider (e.g. Google, GitHub, Azure AD, etc.) that is linked to your account.",
        );
      }

      const isValidPassword = await verifyPassword(
        credentials.password,
        dbUser.password,
      );
      if (!isValidPassword) throw new Error("Invalid credentials");

      const userObj = {
        id: dbUser.id,
        name: dbUser.name,
        email: dbUser.email,

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Confirm the email is registered on this instance (check with an admin or the sign-up flow)
2. Fix typos / verify you're on the right host
3. If the account should exist, check the users table for the exact lowercase email

// Client side: validate email format before submitting the credentials form
if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return showError('Enter a valid email');

When it happens

Trigger: Email/password sign-in where the email has no user record in Postgres.

Common situations: Typos in email; signing in to the wrong instance/environment where the account doesn't exist; sign-up never completed so the user row is absent.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No credentials
• Sign in with email and password is disabled for this instanc
• Sign in with email and password is disabled for this domain.
• ENTERPRISE_SSO_REQUIRED_MESSAGE
• Please sign in with the identity provider (e.g. Google, GitH

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/3b5c312e952b9e41. Report an issue: GitHub.